[20230502] - Core - Bruteforce prevention within the mfa screen

The lack of rate limiting allows brute force attacks against MFA methods...

CVE-2023-23752

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. Recent assessments: noraj at March 24, 2023 9:21am UTC reported: There are at least two ways to achieve RCE. Vector n°1 It leaks the MySQL credentials, in default a...

Joomla! CMS Cross-Site Scripting (CVE-2018-6377)

A cross-site scripting vulnerability exists in Joomla! Core. Successful exploitation results in the execution of arbitrary script code in the target user's browser...

[20221101] - Core - RXSS through reflection of user input in com_media

Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in commedia...

[20221001] - Core - Disclosure of critical information in debug mode

Joomla 4 sites with publicly enabled debug mode exposed data of previous requests...

Joomla! Cross-site scripting vulnerability (CNVD-2022-64103)

Joomla! is a set of forum components used in the Joomla! content management system. 4.0.0 to 4.1.0 versions of Joomla! have a cross-site scripting vulnerability that stems from a filter that incorrectly cleans up and escapes the content in the code, which can be exploited by attackers to execute...

PT-2021-16926 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.26 Description: A missing token check causes a CSRF issue in the "AJAX reordering endpoint". Recommendations: For Joomla! versions 3.0.0 through 3.9.26, update to a version that includes the fix for the...

Joomla 3.0.x < 3.9.26 Multiple Vulnerabilities (5835-joomla-3-9-26)

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 3.9.26. It is, therefore, affected by multiple vulnerabilities: - A cross-site scripting XSS vulnerability exists in the logo parameter of the default templates page due to improper...

Joomla! 输入验证错误漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. An ACL write conflict vulnerability exists in Joomla! 1.7.0-3.9.22. The...

Joomla! cross-site request forgery vulnerability (CNVD-2020-41803)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A security vulnerability exists in Joomla! versions prior to 3.9.19, which stems from a missing token check in compostinstall. The vulnerability can...

Joomla 3.0.x < 3.9.15 Multiple Vulnerabilities (5782-joomla-3-9-15)

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 3.9.15. It is, therefore, affected by multiple vulnerabilities. - An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components...

CVE-2012-1562

Joomla! core before 2.5.3 allows unauthorized password change...

Joomla 3.9.13 - &#039;Host&#039; Header Injection

Exploit Title: Joomla 3.9.13 - 'Host' Header Injection Author: Pablo Santiago Date: 2019-11-12 Vendor Homepage: https://www.joomla.org/ Source: https://downloads.joomla.org/cms/joomla3/3-9-13/Joomla3-9-13-Stable-FullPackage.zip?format=zip Version: 3.9.13 CVE : N/A Tested on: Windows 10 PoC curl...

CVE-2018-18276

XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel...

Joomla ARI Image Slider 2.2.0 Cross Site Request Forgery / Shell Upload

Exploit Title : Joomla ARI Image Slider 2.2.0 CSRF Shell Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 27/03/2019 Vendor Homepage : ari-soft.com Software Download Link : ari-soft.com/Joomla-Components/ARI-Image-Slider/Detailed-product-flyer.html Softwar...

SQL injection vulnerability in Jommla!Po*** component (CNVD-2019-12554)

Joomla! is an open source content management system CMS. A SQL injection vulnerability exists in the Jommla!Po component, which can be exploited by an attacker to obtain sensitive information from the database...

Jommla! St*** component my*** function suffers from SQL injection vulnerability

Joomla! is an open source content management system CMS. A SQL injection vulnerability exists in the my function of the Jommla!St component, which can be exploited by an attacker to obtain sensitive information from the database...

Joomla! cross-site scripting vulnerability (CNVD-2019-15989)

Joomla! is a globally recognized content management system developed using PHP language and MySQL database, which can be implemented on various platforms such as Linux, Windows, MacOSX and so on. A cross-site scripting vulnerability exists in the media form field in versions of Joomla! prior to...

RSAC 2019: Joomla! Flaw Exploited to Create Mass Phishing Infrastructure

SECOND UPDATE Editor’s Note: It has come to our attention that Check Point’s findings are being questioned by Joomla! and others in the open-source ecosystem. Our story accurately reflects Check Point’s report — but it’s clear that the news isn’t about Jmail or the vulnerability which is at least...

Joomla Akeeba Backup 6.3.3 Database Disclosure

Exploit Title : Joomla Akeeba Backup Components 6.3.3 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 19/01/2019 Vendor Homepage : akeebabackup.com Software Information Link : extensions.joomla.org/extension/akeeba-backup/ Software Download...