CVE-2019-7742

An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector...

CVE-2019-7741

An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS...

CVE-2019-7742

An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector...

CVE-2019-7743

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism such as the TYPO3 PHAR stream wrapper to prevent use of the phar:// handler for non .phar-files...

CVE-2019-7739

CVE-2019-7739 affects Joomla! installations prior to 3.9.3. The issue is that the Global Configuration’s No Filtering textfilter overrides child settings, which is described as intended behavior but potentially confusing, due to lack of an explanatory message in the configuration dialog. The conn...

CVE-2019-7740

CVE-2019-7740 affects Joomla! before 3.9.3. The issue is an XSS vulnerability caused by inadequate parameter handling in the core.js function writeDynaList, enabling cross-site scripting in affected Joomla! installations. Connected sources confirm the vulnerability in Joomla! 3.x up to 3.9.2 and ...

CVE-2019-7744

An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability...

CVE-2019-7741

An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS...

CVE-2019-7743

Joomla! before 3.9.3 is vulnerable to an object injection via the phar:// stream wrapper due to a missing protection against using phar:// for non-.phar files. Affected component is the core Joomla! PHP handling (phar wrapper); exploitation could lead to severe impact (high/critical in CVSS terms...

CVE-2019-7741

Joomla! prior to version 3.9.3 is affected by a stored XSS vulnerability in the Global Configuration helpurl setting due to inadequate input validation. The issue allows stored cross-site scripting, as described in CVE-2019-7741, with links to the Joomla security advisory (768-20190204) and corro...

CVE-2019-7744

CVE-2019-7744 is a Joomla! vulnerability affecting versions prior to 3.9.3, where inadequate filtering on URL fields in various core components enables cross-site scripting (XSS). The issue is documented in multiple sources within connected documents, consistently describing an XSS risk due to im...

CVE-2019-7742

Joomla! prior to version 3.9.3 is affected by a cross-site scripting (XSS) vulnerability caused by a combination of specific web server configurations, certain file types, and browser-side MIME-type sniffing. The issue enables an attacker to craft a URL that could execute arbitrary script in a us...

CVE-2019-7740

An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code core.js writeDynaList could lead to an XSS attack vector...

CVE-2019-7739

An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior. However, it might be unexpected for the user because the configuration dialog lacks an additional message to explain this...

Joomla ABook Alexandria Book Library 3.1.4 SQL Injection

Exploit Title : Joomla ABook Alexandria Book Library 3.1.4 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/02/2019 Vendor Homepage : alexandriabooklibrary.org Software Download Link : alexandriabooklibrary.org/en/downloads/18-components.html...

Joomla JoomGallery 3.2.2 / PonyGallery 2.5.1 Database Disclosure / SQL Injection

Exploit Title : Joomla JoomGallery 3.2.2 PonyGallery 2.5.1 SQL Injection / Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/02/2019 Vendor Homepage : joomlander.net - joomlacode.org Software Download Link :...

Joomla BookLibrary 4.0.31 Database Disclosure / SQL Injection

Exploit Title : Joomla BookLibrary 4.0.31 SQL Injection / Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/02/2019 Vendor Homepage : ordasoft.com Software Download Link : ordasoft.com/book-library-joomla-ebook-extension...

Joomla ZCalendar Zap Calendar 4.4.0 SQL Injection

Exploit Title : Joomla ZCalendar Zap Calendar 4.4.0 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/02/2019 Vendor Homepage : zcontent.net - zapcalendar.com Software Download Link : zcontent.net/products/subscriptions Software Information Link :...

Joomla Agora 4.10 Bypass / SQL Injection

Exploit Title : Joomla Agora 4.10 SQL Injection / Authentication Bypass Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/02/2019 Vendor Homepage : joomla4ever.org Software Download Link : joomla4ever.org/archive/ext/comagora.zip Software Information Link :...

Joomla ExtCalendar 2.0 SQL Injection

Exploit Title : Joomla ExtCalendar 2.0 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 12/02/2019 Vendor Homepage : sourceforge.net/projects/extcal/ - github.com/simoami Software Download Link : sourceforge.net/projects/extcal/files/latest/download...