CVE-2020-11889: Undefined Security Weakness

An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of comusers allow the unauthorized deletion of usergroups...

[20200403] - Core - Incorrect access control in com_users access level deletion function

Incorrect ACL checks in the access level section of comusers allow the unauthorized deletion of usergroups...

[20200401] - Core - Incorrect access control in com_users access level editing function

Incorrect ACL checks in the access level section of comusers allow the unauthorized editing of usergroups...

Joomla! < 3.9.6 XSS Vulnerability

This VT has been deprecated due to the CVE already being covered by another script SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Joomla! 1.7.0 <= 3.9.5 XSS Vulnerability

Joomla! is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-11809

An issue was discovered in Joomla! before 3.9.6. The debug views of comusers do not properly escape user supplied data, which leads to a potential XSS attack vector...

CVE-2019-11809

Joomla! before 3.9.6 contains an XSS vulnerability in the debug views of com_users due to improper escaping of user-supplied data. Affects Joomla! versions prior to 3.9.6; exploitation details are not specified in the provided documents. Remediation is a vendor fix: upgrade to 3.9.6 or later.

CVE-2019-11809: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Joomla! before 3.9.6. The debug views of comusers do not properly escape user supplied data, which leads to a potential XSS attack vector...

[20190501] - Core - XSS in com_users ACL debug views

The debug views of comusers do not properly escape user supplied data, which leads to a potential XSS attack vector...

Design/Logic Flaw

An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of comusers lacks access checks, allowing calls from unauthenticated users...

CVE-2019-10946

Joomla! before 3.9.5 is affected by CVE-2019-10946 due to missing access checks on the refresh list of helpsites endpoint in com_users, allowing unauthenticated calls. Affected versions include 3.9.4 and earlier; remediation is to upgrade to Joomla! 3.9.5 (or later) where this is fixed.

CVE-2019-10946: Missing Authentication for Critical Function

An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of comusers lacks access checks, allowing calls from unauthenticated users...

Joomla! 1.5.x < 3.9.5 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A directory traversal vulnerability exists in versions 1.5.0 to 3.9.4 within the Media Manager component due to improperly sanitizing the folder parameter. An authenticated,...

Joomla! 1.5.0 < 3.9.5 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is 1.5.0 or later but prior to 3.9.5. It is, therefore, affected by multiple vulnerabilities: - A directory traversal vulnerability exists in versions 1.5.0 to 3.9.4 within the Media Manager...

[20190402] - Core - Helpsites refresh endpoint callable for unauthenticated users

The "refresh list of helpsites" endpoint of comusers lacks access checks, allowing calls from unauthenticated users...

CVE-2016-9838: Improper Access Control

An issue was discovered in components/comusers/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's account and reset the user's group mappings, username, and...

JoostinaCMS component (com_users) Blind SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

CVE-2008-7214: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a comusers action, as...

CVE-2009-1940: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the administrator panel in the comusers core component for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

joomla -- multiple vulnerabilities

Secunia reports: Some vulnerabilities have been reported in Joomla!, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks. Certain unspecified input is not properly sanitised before being used. This can be...