CVE-2020-10238

HK 制作 CVE-2020-10238: comtemplates における不適切なアクセス制御 - RCE CVE-2020-10239: comfields SQL field における不適切なアクセス制御 - RCE リンク https://developer.joomla.org/security-centre/804-20200303-core-incorrect-access-control-in-com-templates.html...

CVE-2017-8917

CVE-2017-8917 - Joomla 3.7.0 'comfields' SQLインジェクション CVE-2017-8917 の PoC...

CVE-2017-8917

CVE-2017-8917 CVE-2017-8917 - Joomla 3.7.0 'comfields' SQLインジェクション 依存関係 : root@kitploit: pip install art pip install beautifulsoup4 エクスプロイト : root@kitploit: python cve20178917.py...

CVE-2020-10239

作者：HK CVE-2020-10239：comfields SQL字段中的不正确的访问控制 - 远程代码执行 PoC 受影响版本：Joomla核心 3.7.0 至 3.9.15 用户要求：管理员账户（后端最低权限） 获取权限：将您从管理员提升为超级管理员，然后触发远程代码执行。 Joomla中的远程代码执行（RCE） 使用您的凭据运行 cve202010239.py 并访问远程代码执行链接：...

joomla.3.7.0exploit

CVE-2017-8917 Joomla SQLi 概念验证 该仓库包含一个简单、适合 CTF 的 Joomla comfields SQL 注入漏洞（CVE-2017-8917）概念验证（PoC）。其目标是保持工作流轻量，同时展示完整的利用流程：检测、枚举和数据提取。 CVE-2017-8917 概述 漏洞类型 ：Joomla comfields 组件中的 SQL 注入。 根本原因 ：listfullordering 参数未正确过滤，导致 SQL 可被注入到生成的查询中。当使用基于报错的 payload（例如 UpdateXML）构造时，SQL 结果会显示在响应中，从而实现数据提取。...

CVE-2026-48958

In Joomla! Core, the CVE-2026-48958 issue is due to improper access control in the com_fields webservice endpoints, enabling unauthorized users to create custom fields via web services. Affected versions include Joomla! 4.0.x (before 5.4.7) and 6.0.x (before 6.1.2). The underlying impact is eleva...

BIT-JOOMLA-2022-23796 [20220304] - Core - Missing input validation within com_fields class inputs

An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using comfields...

Joomla core 3.7.0-3.10.15-elts,4.0.0-4.4.5,5.0.0-5.1.1 - Unauthenticated XSS in com_fields default field value vulnerability

Unauthenticated XSS in comfields default field value vulnerability discovered by ? in WordPress Core Joomla versions 3.7.0-3.10.15-elts,4.0.0-4.4.5,5.0.0-5.1.1...

CVE-2022-23796

CVE-2022-23796 affects Joomla! 3.7.0 through 3.10.6, where lack of input validation in the com_fields class inputs enables cross-site scripting (XSS). The connected sources confirm the vulnerable component and the XSS impact, but do not specify exploit details or available patches within the prov...

CVE-2022-23796 [20220304] - Core - Missing input validation within com_fields class inputs

An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using comfields...

CVE-2022-23796

An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using comfields...

[20220304] - Core - Missing input validation within com_fields class inputs

Lack of input validation could allow an XSS attack using comfields...

CVE-2020-10239

CVE-2020-10239 affects Joomla! core prior to 3.9.16, where an Incorrect Access Control in the SQL fieldtype of com_fields may allow non‑superadmin users to access restricted data. Affected versions include 3.7.0–3.9.15; the issue is fixed in 3.9.16+. Some connected sources note a GitHub exploit P...

Joomla! access control error vulnerability (CNVD-2020-20998)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. An access control error vulnerability exists in the comfields SQL field in Joomla! versions 3.7.0 through 3.9.15, which can be exploited by attacker...

[20200305] - Core - Incorrect Access Control in com_fields SQL field

Incorrect Access Control in the SQL fieldtype of comfields allows access for non-superadmin users...

Joomla! 3.6.x < 3.8.4 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - The XSS vulnerability in module chromes as noted in the 20180101 announcement affects 3.0.0 through 3.8.3. CVE-2018-6380 - The XSS vulnerability in comfields as noted in the...

Joomla! 3.3.x < 3.8.4 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - The XSS vulnerability in module chromes as noted in the 20180101 announcement affects 3.0.0 through 3.8.3. CVE-2018-6380 - The XSS vulnerability in comfields as noted in the...

Joomla! 3.2.x < 3.8.4 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - The XSS vulnerability in module chromes as noted in the 20180101 announcement affects 3.0.0 through 3.8.3. CVE-2018-6380 - The XSS vulnerability in comfields as noted in the...

Joomla! 1.6.x < 3.8.4 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - The XSS vulnerability in module chromes as noted in the 20180101 announcement affects 3.0.0 through 3.8.3. CVE-2018-6380 - The XSS vulnerability in comfields as noted in the...

Joomla 'com_fields' RCE Vulnerability (20180506)

Joomla is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...