Cross site scripting

An issue was discovered in Joomla! before 3.9.4. The itemtitle layout in edit views lacks escaping, leading to XSS...

CVE-2019-9714

CVE-2019-9714 applies to Joomla! core prior to 3.9.4, where the media form field does not escape input, enabling cross-site scripting (XSS) in affected pages. Multiple sources (NVD, CNVD, osv, prion, Joomla security notice) corroborate that this is a browser-based XSS vulnerability in the media f...

CVE-2019-9712

An issue was discovered in Joomla! before 3.9.4. The JSON handler in comconfig lacks input validation, leading to XSS...

CVE-2019-9714

An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS...

CVE-2019-9713

An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access...

CVE-2019-9711

An issue was discovered in Joomla! before 3.9.4. The itemtitle layout in edit views lacks escaping, leading to XSS...

CVE-2019-9713

CVE-2019-9713 affects Joomla! before 3.9.4. The vulnerability arises from missing ACL checks in the Sample Data plugins, enabling unauthorized access. CVSSv3 base score 7.5 (NETWORK, LOW attack complexity, PR:N, UI:N, S:U, C:H, I:N, A:N); CVSSv2 base score 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N). Implic...

CVE-2019-9712

CVE-2019-9712 concerns Joomla! core prior to version 3.9.4, where the JSON handler in component com_config lacks input validation, enabling cross-site scripting (XSS). The issue is documented across multiple sources (NVD entry, CNVD, OSV, and vendor advisories). Implication: an attacker could cra...

CVE-2019-9711

CVE-2019-9711 affects Joomla! versions before 3.9.4. The issue is an XSS vulnerability caused by lack of escaping in the item_title layout in edit views. This could allow an attacker to inject and execute script in a user’s browser. The documented impact is browser-based XSS; no in-built exploit ...

RSAC 2019: Joomla! Flaw Exploited to Create Mass Phishing Infrastructure

SECOND UPDATE Editor’s Note: It has come to our attention that Check Point’s findings are being questioned by Joomla! and others in the open-source ecosystem. Our story accurately reflects Check Point’s report — but it’s clear that the news isn’t about Jmail or the vulnerability which is at least...

Joomla Zoo by YooTheme Components Information Disclosure Vulnerability

Joomla is an open source content management system CMS. An information disclosure vulnerability exists in Joomla Zoo by YooTheme Components. An attacker can exploit this vulnerability to obtain sensitive information...

Joomla Zoo by YooTheme Components SQL Injection Vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in Joomla Zoo by YooTheme Components. An attacker can exploit this vulnerability to obtain sensitive database information...

Joomla Component HWDVideoShare SQL Injection Vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the Joomla component HWDVideoShare. Allows remote attackers to execute arbitrary SQL commands with different parameters on index.php via "catid itemid=pattern=hwdcorder=videoid=" and have SQL database...

Joomla ModPPCSimpleSpotLight 1.2 / 3.0 CSRF / Shell Upload

Exploit Title : Joomla ModPPCSimpleSpotLight Modules 1.2/3.0 CSRF Shell Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/03/2019 Vendor Homepage : pixelpointcreative.com Software Download Link :...

Joomla Jmail Breaker PHP Web Shell Backdoor

An attacker might upload a web shell backdoor to a Joomla Jmail service. A successful exploitation might allow the attacker to run arbitrary code, or use the server as a bot for further attacks...

Joomla Jmail Breaker Arbitrary File Upload

An attacker might use a web shell backdoor to upload arbitrary files using Joomla Jmail service. A successful exploitation might allow the attacker to run arbitrary code, or use the server as a bot for further attacks...

CMSeeK v1.1.1 - CMS Detection And Exploitation Suite (Scan WordPress, Joomla, Drupal And 150 Other CMSs)

What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.1.1 01-02-2019 - Version 1.1.0...

Joomla J2Store SQL Injection

Exploit Title: J2Store Plugin for Joomla! 3.3.6 - SQL Injection Date: 19/02/2019 Author: Andrei Conache Twitter: @andreiconache Contact: andrei.conacheatprotonmail.com Software Link: https://www.j2store.org Version: 3.x-3.3.6 Tested on: Linux CVE: CVE-2019-9184 1. Description: J2Store is the most...

Joomla Content 3.x SQL Injection

Exploit Title : Joomla Content Components 3.x SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 28/02/2019 Vendor Homepage : joomla.org Software Download Links : github.com/asika32764/joomla-cmf/tree/master/administrator/components/comcontent...

Joomla! Component J2Store < 3.3.7 - SQL Injection

Exploit Title: J2Store Plugin for Joomla! 3.3.6 - SQL Injection Date: 19/02/2019 Author: Andrei Conache Twitter: @andreiconache Contact: andrei.conacheatprotonmail.com Software Link: https://www.j2store.org Version: 3.x-3.3.6 Tested on: Linux CVE: CVE-2019-9184 1. Description: J2Store is the most...