751 matches found
Phoca Maps pre version 6.1.0, other
Phoca Maps pre version 6.1.0, other...
Phoca Guestbook, , Other
https://www.phoca.cz/...
EasyStore Pro 2.0.1, , Other
various...
chronoforms
A new update is now available: https://www.chronoengine.com/downloads/chronoforms/chronoforms-v8/chronoforms-v8-joomla-extension The affected range should be any version before v8.0.53 Best regards, Max & the ChronoEngine.com Team...
[20260711] - Core - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access comprivacy datasets...
[20260710] - Core - Incorrect Access Control in com_modules
An improper access check allows users to display a list of modules in the frontend...
[20260706] - Core - XSS in com_installer
Lack of escaping leads to an XSS vulnerability in the update list view of cominstaller...
[20260707] - Core - XSS in the generic image output layout
Lack of escaping leads to an XSS vulnerability in the generic image output layout...
[20260708] - Core - XSS through language overrides
Improper validation leads to a generic XSS vector in the language override feature...
[20260705] - Core - XSS in various modalreturn layouts
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components...
[20260702] - Core - Incorrect Access Control in com_contact vcf download
An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...
[20260703] - Core - XSS in MFA method management
Lack of validation leads to an XSS vulnerability in the MFA management views...
[20260704] - Core - XSS in com_templates
Lack of escaping leads to an XSS vulnerability in the file management view of comtemplates...
[20260712] - Core - Incorrect Access Control in com_fields webservice endpoints
An improper access check allows unauthorized users to create custom fields via webservices endpoints...
[20260701] - Core - Incorrect Access Control in com_media webservice endpoints
An improper access check allows privileged users to overwrite media files without editing permissions...
[20260520] - Framework - Inadequate content filtering within the cleanAttributes filter code
Lack of input filtering leads to an XSS vector in the HTML filter code...
[20260516] - Core - Incorrect Access Control in com_scheduler
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks...
[20260515] - Core - Incorrect Access Control in sample data plugins
An improper access check allow unauthorized users to perform actions related to the installation of sampledata...
[20260709] - Core - Incorrect Access Control in com_workflow
An improper access check allows unauthorized users to access workflow stage and transition information...
[20260519] - Framework - Inadequate content filtering within the checkAttribute filter code
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components...
[20260518] - Core - Transport encryption downgrade for password and username reset links
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set...
[20260509] - Core - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability...
[20260508] - Core - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to comconfig webservice endpoints...
[20260513] - Core - Privilege escalation through com_users batch task
An improper access check allows privlege escalation through the comusers batch task...
[20260514] - Core - Privilege escalation through com_users webservice endpoints
An improper access check allows privelege escalation through the comusers group editing webservice endpoint...
[20260510] - Core - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
[20260504] - Core - XSS in readmore links
Lack of output escaping leads to a XSS vector in the content history component...
[20260512] - Core - MFA Authentication Bypass
Incorrectly resetted session states to a vector that allows to bypass 2FA checks...
[20260511] - Core - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
[20260503] - Core - XSS in com_contenthistory
Lack of output escaping leads to a XSS vector in the content history component...
[20260502] - Core - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component...
[20260506] - Core - Authenticated blind SQLi in com_finder
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for comfinder...
[20260507] - Core - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in comtags...
[20260501] - Core - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules...
[20260505] - Core - CSRF in user activation endpoint
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of comusers...
[20260305] - Core - Arbitrary file deletion in com_joomlaupdate
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism...
[20260301] - Core - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers...
[20260303] - Core - XSS vector in com_associations comparison view
Lack of output escaping leads to a XSS vector in the multilingual associations component...
[20260304] - Core - XSS vectors in various article title outputs
Lack of output escaping for article titles leads to XSS vectors in various locations...
[20260306] - Core - Improper access check in webservice endpoints
An improper access check allows unauthorized access to webservice endpoints...
[20260302] - Core - SQL injection in com_content articles webservice endpoint
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint...
EasyDiscuss by Stackideas,, , SQL Injection
EasyDiscuss by Stackideas,, , SQL Injection...
Novarain/Tassos Framework, , SQL Injection
allow SQL injection and unauthenticated file reads. Attackers can chain these issues for administrator takeover and remote code execution on unpatched systems. Affected extensions include Convert Forms, EngageBox, Google Structured Data, Advanced Custom Fields, and Smile Pack, all relying on the...
[20260101] - Core - Inadequate content filtering for data URLs
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags...
[20260517] - Core - Incorrect Cache Key Construction for InputFilter objects
The InputFilter::getInstance method omitted a security sensitive parameter from the instance cache key...
Phoca commander
Name: Phoca Company: - Email: [email protected] Extension: Phoca Commander Version: Old 4.0.0, 5.0.1 / New 4.0.2, 5.0.3 Update details: No access for unzip feature as default Update URL: https://github.com/PhocaCz/PhocaCommander/releases/tag/5.0.2 Changelog URL: Download URL:...
[20260102] - Core - XSS vectors in the pagebreak and pagenavigation plugins
Lack of output escaping leads to a XSS vector in the pagebreak and pagenavigation plugins...
[20250902] - Core - User-Enumeration in passkey authentication method
Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method...