Design/Logic Flaw

In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system...

CVE-2018-6380

CVE-2018-6380 affects Joomla! 3.x prior to 3.8.4, due to lack of escaping in the module chromes, resulting in reflected XSS. Affected range includes 3.0.0–3.8.3 per the public entry and Nessus findings explicitly tie this CVE to Joomla! 3.0.x through 3.8.3 in multiple scans. The underlying issue ...