Code injection

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application...

Cross site request forgery (csrf)

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $REQUEST data...

Design/Logic Flaw

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...

Design/Logic Flaw

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in commedia...

CVE-2022-23801

Joomla! 4.0.0–4.1.0 is affected by a cross-site scripting (XSS) vulnerability via an SVG embedding path in com_media. Root cause: improper handling/cleanup of SVG content leading to executable HTML/script in the user’s browser. Public references describe a possible XSS attack vector through SVGs,...

CVE-2022-23801 [20220309] - Core - XSS attack vector through SVG

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in commedia...

CVE-2022-23800 [20220308] - Core - Inadequate content filtering within the filter code

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components...

CVE-2022-23800

CVE-2022-23800 affects Joomla! 4.0.0 through 4.1.0. The issue is insufficient content filtering that enables cross-site scripting (XSS) in various components. The connected documents corroborate the affected range and describe the vulnerability as an XSS due to inadequate filtering, but do not pr...

CVE-2022-23799

CVE-2022-23799 affects Joomla! 4.0.0–4.1.0. The issue arises in JInput where, under certain conditions, input bags are polluted with $_REQUEST data, potentially impacting confidentiality, integrity, and availability. The connected sources confirm the affected range and the root cause (JInput poll...

CVE-2022-23799 [20220307] - Core - Variable Tampering on JInput $_REQUEST data

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $REQUEST data...

CVE-2022-23798

CVE-2022-23798 affects Joomla! core versions 2.5.0–3.10.6 and 4.0.0–4.1.0. The issue is inadequate validation of URLs that can lead to an invalid check of whether a redirect URL is internal or not. This is described in the CVE entry and corroborated by multiple feeds (NVD/OSV/CVE listing). The vu...

CVE-2022-23798 [20220306] - Core - Inadequate validation of internal URLs

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...

CVE-2022-23797

CVE-2022-23797 affects Joomla! core: versions 3.0.0–3.10.6 and 4.0.0–4.1.0. The issue arises from inadequate filtering on the selected Ids in a request, enabling a potential SQL injection. Documented impact is high (based on CVSS3.1: CRITICAL; CVSS2: HIGH). No exploitation details or active explo...

CVE-2022-23797 [20220305] - Core - Inadequate filtering on the selected Ids

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection...

CVE-2022-23796

CVE-2022-23796 affects Joomla! 3.7.0 through 3.10.6, where lack of input validation in the com_fields class inputs enables cross-site scripting (XSS). The connected sources confirm the vulnerable component and the XSS impact, but do not specify exploit details or available patches within the prov...

CVE-2022-23796 [20220304] - Core - Missing input validation within com_fields class inputs

An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using comfields...

CVE-2022-23795

CVE-2022-23795 affects Joomla! 2.5.0–3.10.6 and 4.0.0–4.1.0; a user row was not bound to a specific authentication mechanism, which could under very special circumstances allow an account takeover. The connected sources confirm this as a severe, likely authenticated-access issue with high impact ...

CVE-2022-23795 [20220303] - Core - User row are not bound to a authentication mechanism

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover...

CVE-2022-23794

CVE-2022-23794 affects Joomla! 3.0.0–3.10.6 and 4.0.0–4.1.0. Uploading a filename with excessive length triggers an error that reveals the web application’s source code path via filesystem error messages, constituting information disclosure. The public-facing sources (NVD, OSV, CVE records) descr...

CVE-2022-23794 [20220302] - Core - Path Disclosure within filesystem error messages

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application...