CVE-2023-23751

CVE-2023-23751 affects Joomla! 4.0.0–4.2.4 and arises from a missing ACL check in com_actionlogs, enabling non super-admin users to access it. The connected sources (OSV, NVD, and security trackers) confirm a privilege/ACL bypass rather than a bypass tied to authentication tokens or input handlin...

CVE-2023-23750 [20230101] - Core - CSRF within post-installation messages

An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages...

CVE-2023-23750

CVE-2023-23750 : Joomla! Core on versions 4.0.0–4.2.6 suffers a CSRF vulnerability in the handling of post-installation messages due to a missing token check. The issue could enable unauthorized actions via forged requests within the affected workflow. Public sources in connected documents confir...

CVE-2023-23750 [20230101] - Core - CSRF within post-installation messages

An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages...

Joomla! 跨站请求伪造漏洞

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! versions 4.0.0 through 4.2.6, which stems from a missing token check. An attacker can exploit this vulnerability to perform cross-site request forgery attacks...

PT-2023-19175 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 4.0.0 through 4.2.6 Description: A missing token check causes a CSRF vulnerability in the handling of post-installation messages. This issue affects the handling of post-installation messages, potentially allowing for...

Joomla! 安全漏洞

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! versions 4.0.0 through 4.2.4, which stems from a missing ACL check...

PT-2023-19176 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 4.0.0 through 4.2.4 Description: An issue was discovered that allows non super-admin users to access com actionlogs due to a missing ACL check. Recommendations: For Joomla! versions 4.0.0 through 4.2.4, consider restricting...

Joomla API Improper Access Checks

Joomla versions between 4.0.0 and 4.2.7, inclusive, contain an improper API access vulnerability. This vulnerability allows unauthenticated users access to webservice endpoints which contain sensitive information. Specifically for this module we exploit the users and config/application endpoints...

OpenLDAP 注入漏洞

OpenLDAP is an open source implementation of the Lightweight Directory Access Protocol LDAP from the OpenLDAP Foundation in the United States. A security vulnerability exists in the Joomla plugin LDAP Integration with Active Directory and OpenLDAP that stems from not properly cleaning the POST...

Sql injection

A vulnerability was found in mrtnmtth joomlamodeinsatzstats up to 0.2. It has been classified as critical. This affects the function getStatsByType of the file helper.php. The manipulation of the argument year leads to sql injection. Upgrading to version 0.3 is able to address this issue. The...

CVE-2016-15016

CVE-2016-15016 affects the Joomla plugin joomla_mod_einsatz_stats (versions up to 0.2). The vulnerability is in the helper.php function getStatsByType, where manipulating the year parameter leads to SQL injection. A fix is available in version 0.3, with the patch identified as 27c1b443cff45c81d9d...

joomla_mod_einsatz_stats SQL注入漏洞

joomlamodeinsatzstats is an application of mrtnmtth individual developer. Show Einsatzkomponente data statistics in charts and graphs. An SQL injection vulnerability exists in mrtnmtth joomlamodeinsatzstats versions prior to 0.3, which stems from a problem with the function getStatsByType in the...

PT-2023-10335 · Joomla · Joomla Mod Einsatz Stats

Name of the Vulnerable Software and Affected Versions: joomla mod einsatz stats versions up to 0.2 Description: A critical issue was found, affecting the getStatsByType function in the helper.php file. The manipulation of the year argument leads to SQL injection. Recommendations: For versions up ...

CVE-2010-10003

A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugincontenttitle.php. The manipulation of the argument phrase leads to sql injection. The patch is named...

Sql injection

A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugincontenttitle.php. The manipulation of the argument phrase leads to sql injection. The patch is named...

CVE-2010-10003 gesellix titlelink plugin_content_title.php sql injection

A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugincontenttitle.php. The manipulation of the argument phrase leads to sql injection. The patch is named...

CVE-2010-10003 gesellix titlelink plugin_content_title.php sql injection

A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugincontenttitle.php. The manipulation of the argument phrase leads to sql injection. The patch is named...

CVE-2010-10003

The CVE-2010-10003 entry concerns gesellix titlelink for Joomla. The vulnerability affects the file plugin_content_title.php, where manipulation of the phrase argument leads to SQL injection. A patch is available (hash: b4604e523853965fa981a4e79aef4b554a535db0) and should be applied to fix the is...

titlelink SQL注入漏洞

titlelink is a Joomla system plugin that makes it easy to create links to other Joomla content within Joomla content via titles or aliases. A SQL injection vulnerability exists in titlelink, which stems from unknown functionality in the file plugincontenttitle.php, and can be exploited by an...