19181 matches found
BIT-JOOMLA-2024-40749 [20250103] - Core - Read ACL violation in multiple core views
Improper Access Controls allows access to protected views...
PT-2025-23926 · Joomla · Rsmail!
Name of the Vulnerable Software and Affected Versions: RSMail! component versions 1.19.20 through 1.22.26 for Joomla Description: A stored XSS issue was discovered in the RSMail! component for Joomla, where user-supplied input is not properly sanitized before being stored and rendered within the...
PT-2025-23923 · Joomla · Rsfirewall
Name of the Vulnerable Software and Affected Versions: RSFirewall component versions 2.9.7 through 3.1.5 for Joomla Description: A path traversal issue allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient sanitization of...
CVE-2025-27444
A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filterdateFrom GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin o...
CVE-2025-27444
A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filterdateFrom GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin o...
CVE-2025-27444
CVE-2025-27444 affects RSform!Pro (Joomla) 3.0.0–3.3.13. Root cause: improper handling of the filter[dateFrom] GET parameter leads to reflected XSS in the administrative backend when an authenticated admin/editor clicks a crafted URL. Impact: potential injection of arbitrary JavaScript in the adm...
CVE-2025-27444 Extension - rsjoomla.com - A reflected XSS vulnerability RSform!Pro component 3.0.0 - 3.3.13 for Joomla
A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filterdateFrom GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin o...
CVE-2025-27444 Extension - rsjoomla.com - A reflected XSS vulnerability RSform!Pro component 3.0.0 - 3.3.13 for Joomla
A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filterdateFrom GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin o...
PT-2025-23775 · Joomla · Rsform!Pro
Name of the Vulnerable Software and Affected Versions: RSform!Pro component versions 3.0.0 through 3.3.13 for Joomla Description: A reflected XSS issue was discovered, arising from the improper handling of the filterdateFrom GET parameter, which is reflected unescaped in the administrative backen...
CVE-2024-21727
XSS vulnerability in DP Calendar component for Joomla...
CVE-2024-21728
An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky osTicket Bridge by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return paramete...
CVE-2024-5735
Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0...
CVE-2024-32788
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Joomla to WordPress.This issue affects FG Joomla to WordPress: from n/a through 4.20.2...
CVE-2024-5736
Server Side Request Forgery SSRF vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0...
CVE-2024-5737
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default text/html is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0...
CVE-2024-24837
Cross-Site Request Forgery CSRF vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce, Frédéric GILLES FG Drupal to WordPress, Frédéric GILLES FG Joomla to WordPress.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.44.3; FG Drupal to WordPress: from n/a through 3.67.0; ...
CVE-2024-40744
Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8...
CVE-2024-40745
Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8...