EUVD-2014-7831

Malware in sbrugna...

EUVD-2014-7830

Malware in sbrugna...

Joomla! CMS 安全漏洞

Joomla! CMS is an open source content management system for Joomla! A security vulnerability exists in the Joomla! CMS input filtering framework, which stems from improper handling of inputs to the checkAttribute method and could lead to a cross-site scripting attack...

CVE-2014-7983

Cross-site scripting XSS vulnerability in comcontact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-7981

SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-7984

Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication...

GHSA-6423-85CC-8GF6 Joomla CMS Multi-Factor Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

Joomla CMS Multi-Factor Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

[20250402] - Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

[20250301] - Core - Malicious file uploads via Media Manager

Inadequate checks in the Media Manager allowed users with "edit" privileges to create executable PHP files...

[20250201] - Core - SQL injection vulnerability in Scheduled Tasks component

Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of comscheduler...

[20250102] - Core - XSS vector in the id attribute of menu lists

Lack of output escaping in the id attribute of menu lists...

Joomla! 3.x < 3.10.17 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.10.17, 4.x prior to 4.4.7 or 5.x prior to 5.1.3. It is, therefore, affected by multiple vulnerabilities. - The stripImages and stripIframes methods didn't properly process inputs,...

[20250101] - Core - XSS vectors in module chromes

Various module chromes didn't properly process inputs, leading to XSS vectors...

[20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

PT-2024-21720 · Unknown · Joomla! Cms

Name of the Vulnerable Software and Affected Versions: Joomla CMS versions 3.10.16, 4.4.6, 5.1.2 Description: The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. This issue poses undisclosed risks via remote attack. Recommendations: For Joomla C...

[20240803] - Core - XSS in HTML Mail Templates

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

[20240702] - Core - Self-XSS in fancyselect list field layout

The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector...

[20240204] - Core - XSS in mail address outputs

Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components...

New Hacker Group 'GambleForce' Tageting APAC Firms Using SQL Injection Attacks

A previously unknown hacker outfit called GambleForce has been attributed to a series of SQL injection attacks against companies primarily in the Asia-Pacific APAC region since at least September 2023. "GambleForce uses a set of basic yet very effective techniques, including SQL injections and th...