CVE-2019-19634

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576...

CVE-2019-19634

CVE-2019-19634 affects verot.net class.upload.php up to version 2.0.4 (and 1.0.3 in some builds) used in Joomla! K2 extension; it omits .pht from dangerous extensions, enabling arbitrary file upload and remote code execution. An exploit/POC demonstrates obtaining a shell via a crafted image uploa...

PT-2019-15893

Name of the Vulnerable Software and Affected Versions class.upload.php versions 1.0.0 through 1.0.3 class.upload.php versions 2.0.0 through 2.0.4 Description The issue is related to the omission of .pht from the set of dangerous file extensions in class.upload.php, which is similar to a previousl...

CVE-2019-19576

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...

CVE-2019-19576

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...

Code injection

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...

CVE-2019-19576

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions...

CVE-2013-6878

Cross-site scripting XSS vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search...

CVE-2013-6879

The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search...

Design/Logic Flaw

The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message...

CVE-2013-6878

The CVE-2013-6878 entry concerns MijoSearch Joomla extension (versions 2.0.4 and earlier). The connected HTB advisory documents two vulnerabilities in MijoSearch: (1) CVE-2013-6878, a Cross-Site Scripting (XSS) flaw caused by insufficient sanitisation of user-supplied data appended to "/component...

CVE-2013-6878

Cross-site scripting XSS vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search...

CVE-2013-6879

The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message...

CVE-2013-6879

The connected HTB advisory details CVE-2013-6879 in MijoSearch for Joomla! (version 2.0.1 and earlier). The vulnerability arises from improper error handling in /component/mijosearch/search, which allows an attacker to obtain the full installation path via an externally generated error message (i...

Joomla! Core Multiple SQL Injection and Information Disclosure Vulnerabilities

Description Joomla! Core is prone to an information-disclosure vulnerability and SQL-injection vulnerability. An attacker can exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database and gain access to sensitive...

Joomla 3.9.x < 3.9.9 Joomla 3.9.9 Release (5772-joomla-3-9-9-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.9.x prior to 3.9.9. It is, therefore, affected by a vulnerability. - In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering...

Shack Forms Pro extension path traversal vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters team using PHP and MySQL development of a set of open source, cross-platform content management system CMS. Shack Forms Pro extension is used in one of the form creation plugin . A path traversal vulnerability exists in the Shack Forms Pro extension for...

Joomla! 3.2.x < 3.9.13 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A cross-site request forgery CSRF exists in versions 3.2.0 to 3.9.12 due to a missing token check in comtemplate - A path disclosure vulnerability exists in versions 3.6.0 t...

CVE-2014-1214

views/upload.php in the ProJoom Smart Flash Header NovaSFH component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary files via a crafted 1 dest parameter and 2 arbitrary extension in the Filename parameter...