[20250301] - Core - Malicious file uploads via Media Manager

Inadequate checks in the Media Manager allowed users with "edit" privileges to create executable PHP files...

[20250201] - Core - SQL injection vulnerability in Scheduled Tasks component

Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of comscheduler...

[20250102] - Core - XSS vector in the id attribute of menu lists

Lack of output escaping in the id attribute of menu lists...

Joomla! 3.x < 3.10.17 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.10.17, 4.x prior to 4.4.7 or 5.x prior to 5.1.3. It is, therefore, affected by multiple vulnerabilities. - The stripImages and stripIframes methods didn't properly process inputs,...

[20250101] - Core - XSS vectors in module chromes

Various module chromes didn't properly process inputs, leading to XSS vectors...

[20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

PT-2024-21720 · Unknown · Joomla! Cms

Name of the Vulnerable Software and Affected Versions: Joomla CMS versions 3.10.16, 4.4.6, 5.1.2 Description: The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. This issue poses undisclosed risks via remote attack. Recommendations: For Joomla C...

[20240803] - Core - XSS in HTML Mail Templates

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

[20240702] - Core - Self-XSS in fancyselect list field layout

The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector...

[20240204] - Core - XSS in mail address outputs

Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components...

New Hacker Group 'GambleForce' Tageting APAC Firms Using SQL Injection Attacks

A previously unknown hacker outfit called GambleForce has been attributed to a series of SQL injection attacks against companies primarily in the Asia-Pacific APAC region since at least September 2023. "GambleForce uses a set of basic yet very effective techniques, including SQL injections and th...

[20230502] - Core - Bruteforce prevention within the mfa screen

The lack of rate limiting allows brute force attacks against MFA methods...

CVE-2023-23752

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. Recent assessments: noraj at March 24, 2023 9:21am UTC reported: There are at least two ways to achieve RCE. Vector n°1 It leaks the MySQL credentials, in default a...

Joomla! CMS Cross-Site Scripting (CVE-2018-6377)

A cross-site scripting vulnerability exists in Joomla! Core. Successful exploitation results in the execution of arbitrary script code in the target user's browser...

[20221101] - Core - RXSS through reflection of user input in com_media

Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in commedia...

[20221001] - Core - Disclosure of critical information in debug mode

Joomla 4 sites with publicly enabled debug mode exposed data of previous requests...

Joomla! Cross-site scripting vulnerability (CNVD-2022-64103)

Joomla! is a set of forum components used in the Joomla! content management system. 4.0.0 to 4.1.0 versions of Joomla! have a cross-site scripting vulnerability that stems from a filter that incorrectly cleans up and escapes the content in the code, which can be exploited by attackers to execute...

PT-2021-16926 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.26 Description: A missing token check causes a CSRF issue in the "AJAX reordering endpoint". Recommendations: For Joomla! versions 3.0.0 through 3.9.26, update to a version that includes the fix for the...

Joomla 3.0.x < 3.9.26 Multiple Vulnerabilities (5835-joomla-3-9-26)

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 3.9.26. It is, therefore, affected by multiple vulnerabilities: - A cross-site scripting XSS vulnerability exists in the logo parameter of the default templates page due to improper...

Joomla! 输入验证错误漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. An ACL write conflict vulnerability exists in Joomla! 1.7.0-3.9.22. The...