62 matches found
CVE-2021-23132
CVE-2021-23132 画像アップロードを意図していないcommediaの許可パスを利用したRCE。 CVE-2020-24597 commediaのディレクトリトラバーサルによるRCE 2つのCVEは同一のものです。 PoC（完全版） 影響を受けるバージョン：Joomla core =3.9.24 必要なユーザー権限：管理者アカウント（スーパーユーザーではない） 権限の取得：スーパーユーザーを作成し、その後RCEを実行します。 Joomlaにおけるリモートコード実行（RCE） 認証情報を使用して cve-2021-23132.py を実行し、RCEリンクにアクセスします：...
CVE-2020-24597
HK 製 CVE-2020-24597: commedia のディレクトリトラバーサルによる RCE 注: Joomla コア 3.9.21 は不適切に修正されたため、このバグは適切にパッチされていません。このパッチは簡単に回避できます。このバグが完全に修正されるまで、この内容を秘密にしておきたいと思います。 リンク https://developer.joomla.org/security-centre/827-20200803-core-directory-traversal-in-com-media.html PoC 完全版 影響を受けるバージョン: Joomla コア =3.9....
BIT-JOOMLA-2026-48947 Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints
An improper access check allows privileged users to overwrite media files without editing permissions...
CVE-2026-48947
Technical details (affected products, exact vulnerable component, exploit methods, and fixes) are not disclosed in the provided documents. Monitor for updates.
BIT-JOOMLA-2026-40384 Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
ANT-2026-GSV3GS1G · joomla · Path-traversal
path-traversal medium CVE-2026-40384 GHSA-hr66-rv65-f5r4 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-GSV3GS1G: Path...
CVE-2026-40384
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
CVE-2026-40384
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
CVE-2026-40384
CVE-2026-40384 affects Joomla! Core — com_media webservice endpoint. The issue is improper validation of the search parameter in the com_media files API, enabling path traversal. Documented across NVD, CVE records, and security feeds; impact described as path traversal with high confidentiality i...
CVE-2026-40384: Improper Limitation of a Pathname to a Restricted Directory
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
[20260701] - Core - Incorrect Access Control in com_media webservice endpoints
An improper access check allows privileged users to overwrite media files without editing permissions...
[20260510] - Core - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
EUVD-2021-12862
Malware in sbrugna...
BIT-JOOMLA-2022-27914 [20221101] - Core - RXSS through reflection of user input in com_media
An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in commedia...
BIT-JOOMLA-2022-23801 [20220309] - Core - XSS attack vector through SVG
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in commedia...
BIT-JOOMLA-2021-23132 [20210306] - Core - com_media allowed paths that are not intended for image uploads
An issue was discovered in Joomla! 3.0.0 through 3.9.24. commedia allowed paths that are not intended for image uploads...
Joomla! 4.0.0 - 4.2.4 XSS Vulnerability
Joomla! is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...
CVE-2022-27914
An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in commedia...
