751 matches found
Membership Pro and other OS Solution extensions
Os Solution products have fixed an issue in the Paypal payment gateway in five of their extensions and made new releases to fix it:- 1. Events Booking version 2.14.2 https://www.joomdonation.com/forum/events-booking-general-discussion/57320-events-booking-version-2-14-2-released.html 2...
PayPal IPN for DOCman by shopfiles.com,3.1,SQL Injection
PayPal IPN for DOCman by shopfiles.com, 3.1, SQL Injection...
JO Facebook gallery,4.5,SQL Injection
JO Facebook gallery by Joomcore.com, 4.5,SQL Injection resolution: update to 4.6 Update Notice URL http://joomcore.com/news-updates/item/109-update-jo-facebook-gallery-to-version-4-6-fixed-problem-sql-injection-in-version-4-5...
AVChat Video Chat Integration Kit, File permissions
AVChat Video Chat Integration Kit, File permissions...
aceftp,unknown version,Other
aceftp abandonware,unknown, Download Permssion Extension not currently under development, probably all versions affected...
Komento 2.0.6, xss
We just released Komento 2.0.7 to address a security issue where a remote attacker may be able to launch an xss attack in prior versions of Komento. update notice: https://stackideas.com/blog/important-komento-2-0-7-security-fix...
[20170408] - Core - Information Disclosure
Multiple files caused full path disclosures on systems with enabled error reporting...
EasySocial versions before 1.4.7
EasySocial versions before 1.4.7: Code injection Resolution: update to 1.4.7 Update notice: http://stackideas.com/blog/critical-update-for-easysocial-update-to-1-4-7-now...
OS Property - Joomla Real Estate sqli pre 2.8.1
OS Property - Joomla Real Estate sqli 12th May 2014 - New version 2.8.1 ============== Bug Fixed =============== 1. SQL Injection solved developer did not inform VEL...
"Simple Email Form" by unlikelysource.com, 1.8.5 and below
"Simple Email Form" by unlikelysource.com, 1.8.5 and older; XSS Resolution: update to version 1.8.6 Update notice URL: http://joomla.unlikelysource.org/index.php...
youtube plugin - youtubejoomla ,1.1
youtube plugin - Stian Totland,1.1 ,Other , youtubejoomla...
JCE - Joomla Content Editor 2.4.5 and previous
Versions 2.4.5 and previous Update to Version 2.4.6 improves security in add-on installation system UpdateNoticeURL https://www.joomlacontenteditor.net/news/item/jce-246-released...
Admin Exile 2.3.5 sqli
Admin Exile version 2.3.5 SQL injection Developer Update Version 2.3.6 resolves an unpublished/theoretical SQL injection vulnerability. http://www.richeyweb.com/development/joomla-plugins/71-adminexile-for-joomla-16...
Watchful Client (watchful.li extension), 1.9.0 and lower
Extension was not preventing execution of files outside of the framework, and therefore enabling potential unwanted information disclosure and other attacks using weak hash key implementation. Update to version 1.9.1 : https://watchful.li/news/watchful-1-9-1-released.html...
ActiveHelper LiveHelp, 3.2.0, sqli
ActiveHelper LiveHelp, 3.2.0, SQL Injection We already updated the LiveHelp Server to the version 3.3.0 that include a security patch that fixes the reported issue. We also include a few improvements on other units. Update Notice URL...
ODude Ecard - DT
ODude Ecard - DT - 777 developer statement - ODude Ecard Version 2.1 http://www.odude.com/main/odude-ecard/ecard-log.html...
iRecommend, >= 3.0,
iRecommend, = 3.0, Other XSS & FPD developer states inaccurate report...
aiContactSafe 2.0.19
xss 160413 developer release statement for version 2.0.21 Authors:...
[20120203] - Core - Information Disclosure
Inadequate validation leads to path disclosure in administrator...
Phoca Maps pre version 6.1.0, other
Phoca Maps pre version 6.1.0, other...
[20250102] - Core - XSS vector in the id attribute of menu lists
Lack of output escaping in the id attribute of menu lists...
[20240801] - Core - Inadequate validation of internal URLs
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...
osTicky2, , Other
This extension is abandoned and should be removed from your site...
bagallery , , Other
Developer statement Old 1.1 / New 1.2 Update details: We have thoroughly tested all the code in our component to ensure it is free of any security issues. Update URL: https://bestaddon.com/product/ba-gallery/Changelog...
fabrik 3.9,Various
,fabrik 3.9. Various Issues NOTE: the earlier version number was a mistake by the reporter. new version number 3.9.1 Update Notice URL https://fabrikar.com/blog/87-fabrik-3-9-1-released...
Edocman,1.1.17,SQL Injection
Edocman,1.1.17,SQL Injection Extension Update Details Fix security issue on Joomla SQL injection from previous Edocman version. new version number 1.11.8 UpdateNotice URL...
CW Article Attachments (Free Version), SQL Injection
CW Article Attachments Free Version from cwjoomla.com, versions 1.0.6 and previous, SQL Injection resolution: update to 1.0.7 update notice: http://www.cwjoomla.com/download-cw-article-attachments...
Calendar Planner 1.0.1 - SQL Injection
Calendar Planner 1.0.1 - SQL Injection resolution: update to 1.0.2 update notice: http://www.joomlathat.com/news/news/calendar-planner/calendar-planner-1-0-2-security-release...
Zap Calendar, 4.3.6 and previous, SQL Injection
Zap Calendar, 4.3.6, SQL Injection resolution: update to 4.3.7 update notice url: https://zcontent.net/support/zapcalendar/265-change-log-for-zap-calendar...
HikaShop Business,3.1.0,SQL Injection
HikaShop Business,3.1.0,SQL Injection new version number 3.1.1 Update Notice URL https://www.hikashop.com/home/blog/373-security-release-for-hikashop-business.html...
Extra Search by Joomlaboat,2.2.8 and previous,SQL Injection
Extra Search by Joomlaboat, 2.2.8 and previous, SQL Injection...
Joomloc-CAT, version 4.1.3, SQL injection
Joomloc-CAT, version 4.1.3, SQL injection Resolution: update to 4.2.1 Update Notice URL http://www.joomloc.fr.nf/en/downloads-products/file/joomloc-pro-channel-manager-pms.html...
JE Property Finder, 1.6.3
JE Property Finder,1.6.3,SQL Injection...
joomunited SEO Glossary ,pre 2.2.4,Other
joomunited SEO Glossary , pre 2.2.4,Other Developer statement in mass email to registered users We just fixed an SEO Glossary vulnerability, an update to version 2.2.4 is required as soon as possible. https://www.joomunited.com/changelog/seo-glossary-changelog Fix informed by user...
Huge IT Video Gallery,1.1.1,XSS (Cross Site Scripting)
Huge IT Video Gallery,1.1.1,XSS Cross Site Scripting Also versions 1.0.9 and previous have SQL injection vulnerability Resolution: update to version 1.1.3 Update notice: https://huge-it.com/joomla-extensions-security-notice/...
[20160802] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability in mail component...
Event Manager, 2.1.4 and below, multiple vulnerabilities
Event Manager, 2.1.4 and below, SQLi and Unrestricted File Upload Fixed in version 2.1.4.2 Notice: http://www.joomlaeventmanager.net/project/changelog-jem-2...
Escope PrettyPhoto [mod_escope_pp], 1.0.3, XSS (Cross Site Scripting) - abandonware!
Escope PrettyPhoto modescopepp, 1.0.3 and below, XSS Cross Site Scripting...
BeestoHelpDesk, 3.1.1 and probably all previous,Information Disclosure
BeestoHelpDesk, 3.1.1 and probably all previous,Information Disclosure Resolution: update to version 3.1.2 or 2.5.2 for users of Joomla 2.5.x update notice: http://beesto.com/forum/read.php?25,1963,1963msg-1963...
Football [com_football],SQL Injection
Component comfootball, unknown version possibly joomleague fork SQL Injection...
Face Gallery by Apptha [com_facegallery] version 1.0
Face Gallery by Apptha comfacegallery, version 1.0 exploit: Other...
plg_highlight_button, 1.5 and previious sqli
plghighlightbutton, 1.5 and previious versions, SQL Injection Update notice: http://www.jonijnm.es/web/descargas/category/9-highlight-code.html...
JJ Shoutbox, 1.2.6,
JJ Shoutbox, 1.2.6, Other Developer statement This security issue was for version 1.2.6 of JJ Shoutbox. We fixed this issue last night and released version 1.3.0 http://joomjunk.co.uk/products/module-home/shoutbox.htmlchangelog...
jomsocial below 3.0.5.1
jomsocial , 3.0.5.1, SQL Injection Resolved prior to notification...
[20120902] - Core - XSS Vulnerability
Inadequate escaping of output leads to XSS vulnerability in language switcher module...
[20111001] - Core - Information Disclosure
Weak encryption causes potential information disclosure...
[20090602] - Core - ja_purity XSS
A XSS vulnerability exists in the JAPurity template which ships with Joomla! 1.5...
[20260101] - Core - Inadequate content filtering for data URLs
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags...
Advanced custom fields, 2.7.7, SQL Injection
Version: Old 2.8.2 / New 2.8.3 Update details: Improved sanitization/escaping of custom field values in v2.8.3 Update URL: https://www.tassos.gr/releases/advanced-custom-fields/advanced-custom-fields-2-8-3?format=htmlChangelog...