761 matches found
AP Portfolio [mod_ap_portfolio], 3.3 and below, XSS (Cross Site Scripting)
AP Portfolio modapportfolio, 3.3.1 and below, XSS Cross Site Scripting Extension includes vulnerable JS library prettyPhoto Vulnerability fixed in version 3.3.2 Update notice:http://aplikko.com/joomla-extensions/ap-portfolio...
OS Property - Joomla Real Estate sqli pre 2.8.1
OS Property - Joomla Real Estate sqli 12th May 2014 - New version 2.8.1 ============== Bug Fixed =============== 1. SQL Injection solved developer did not inform VEL...
"Simple Email Form" by unlikelysource.com, 1.8.5 and below
"Simple Email Form" by unlikelysource.com, 1.8.5 and older; XSS Resolution: update to version 1.8.6 Update notice URL: http://joomla.unlikelysource.org/index.php...
Jdownloads Pre 3.2.23
Jdownloads Extension Update Details Version 3.2.23 eliminates two vulnerabilities to prevent SQL injections. Only low risk. UpdateNoticeURL http://www.jdownloads.com/index.php?option=comcontent=article=234:jdownloads-3223-beta-published=51:news...
J2Store 2.5 to 2.8.3, SQL Injection
J2Store 2.5 to 2.8.3 SQL Injection Update to 2.8.4 UpdateNoticeURL http://j2store.org/blog/213-security-update-january-2015.html...
EDVAS blank template pre 3.5.1
Blank bootstrap edition Template : Update Details http://github.com/Bloggerschmidt/Blank-Bootstrap-Edition/releases/tag/v3.5.1 See https://github.com/Bloggerschmidt/Blank-BootstrapEdition...
Admin Exile 2.3.5 sqli
Admin Exile version 2.3.5 SQL injection Developer Update Version 2.3.6 resolves an unpublished/theoretical SQL injection vulnerability. http://www.richeyweb.com/development/joomla-plugins/71-adminexile-for-joomla-16...
Hika Shop
HikaShop 2.3.2 and below also Hika Market 1.4.3 and below Remote code execution Note that developer did not inform the VEL Notice of resolution: http://www.hikashop.com/index.php?option=comcontent=article=269...
plg_highlight_content, 1.5 and previous
plghighlightcontent, 1.5 and previious versions, XSS Cross Site Scripting update notice: http://www.jonijnm.es/web/descargas/category/9-highlight-code.html...
ActiveHelper LiveHelp, 3.2.0, sqli
ActiveHelper LiveHelp, 3.2.0, SQL Injection We already updated the LiveHelp Server to the version 3.3.0 that include a security patch that fixes the reported issue. We also include a few improvements on other units. Update Notice URL...
ODude Dir - DT
ODude DIR - DT-777 developer statement ODude Dir 1.1 updated with fixed securities issues. http://www.odude.com/main/dir/dir-log.html...
ODude Ecard - DT
ODude Ecard - DT - 777 developer statement - ODude Ecard Version 2.1 http://www.odude.com/main/odude-ecard/ecard-log.html...
aiContactSafe 2.0.19
xss 160413 developer release statement for version 2.0.21 Authors:...
[20120306] - Core - Information Disclosure
Inadequate permission checking allows unauthorised viewing of administrative back end information...
[20260511] - Core - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
Advanced custom fields, 2.7.7, SQL Injection
Version: Old 2.8.2 / New 2.8.3 Update details: Improved sanitization/escaping of custom field values in v2.8.3 Update URL: https://www.tassos.gr/releases/advanced-custom-fields/advanced-custom-fields-2-8-3?format=htmlChangelog...
osTicky2, , Other
This extension is abandoned and should be removed from your site...
bagallery , , Other
Developer statement Old 1.1 / New 1.2 Update details: We have thoroughly tested all the code in our component to ensure it is free of any security issues. Update URL: https://bestaddon.com/product/ba-gallery/Changelog...
PayPlans,4.0, ID
PayPlans,4.0, ID https://stackideas.com/blog/payplans-4013 Update to 4.0.13...
[20190502] - Core - By-passing protection of Phar Stream Wrapper Interceptor
In Joomla 3.9.3, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the Joomla core. In order to intercept file invocations like fileexists or stat on compromised Phar archives the base name has to be determined and...
Simple Image Gallery (free) 3.5.0 and previous, XSS
Simple Image Gallery Freed by Joomlaworks, version 3.5.0 and previous, XSS Resolution: update to 3.6.0 Update notice: https://www.joomlaworks.net/blog/item/269-simple-image-gallery-free-v3-6-0-released-featuring-enhanced-print-previews-fixing-xss-vulnerability-related-to-print-page-output Note th...
Membership Pro and other OS Solution extensions
Os Solution products have fixed an issue in the Paypal payment gateway in five of their extensions and made new releases to fix it:- 1. Events Booking version 2.14.2 https://www.joomdonation.com/forum/events-booking-general-discussion/57320-events-booking-version-2-14-2-released.html 2...
PayPal IPN for DOCman by shopfiles.com,3.1,SQL Injection
PayPal IPN for DOCman by shopfiles.com, 3.1, SQL Injection...
BookLibrary,3.6.14,SQL Injection
BookLibrary by Ordasoft, 3.6.14, SQL Injection Resolutiion: Update to 3.6.15 Update notice: http://ordasoft.com/News/News/book-library-security-update.html...
JO Facebook gallery,4.5,SQL Injection
JO Facebook gallery by Joomcore.com, 4.5,SQL Injection resolution: update to 4.6 Update Notice URL http://joomcore.com/news-updates/item/109-update-jo-facebook-gallery-to-version-4-6-fixed-problem-sql-injection-in-version-4-5...
hwdVideoShare,N/A
hwdVideoShare,N/A,SQL Injection Dev Statement The hwdVideoShare comhwdvideoshare extension was retired 3 years ago, and we deleted it from the Joomla Extensions Directory. It was replaced by a completely new extension called HWDMediaShare...
joomunited SEO Glossary ,pre 2.2.4,Other
joomunited SEO Glossary , pre 2.2.4,Other Developer statement in mass email to registered users We just fixed an SEO Glossary vulnerability, an update to version 2.2.4 is required as soon as possible. https://www.joomunited.com/changelog/seo-glossary-changelog Fix informed by user...
AVChat Video Chat Integration Kit, File permissions
AVChat Video Chat Integration Kit, File permissions...
aceftp,unknown version,Other
aceftp abandonware,unknown, Download Permssion Extension not currently under development, probably all versions affected...
EasySocial versions before 1.4.7
EasySocial versions before 1.4.7: Code injection Resolution: update to 1.4.7 Update notice: http://stackideas.com/blog/critical-update-for-easysocial-update-to-1-4-7-now...
Extplorer, 2.1.7 and previous
Developer startement eXtplorer 2.1.8 released Today eXtplorer 2.1.8 was released, fixing some minor vulnerabilities. Changelog: - added security functions for protection against CSRF attacks - fixed "directories with the name '0' are not loading" An update is recommended...
Master User, versions before 2.1.4
Versions before 2.1.4 suffered from an issue with insecure default settings, the issue affects Joomla 3.4 sites only, but users are advised by the developer to update anyway. Resolution: Update to version 2.1.4 Update notice URL:...
BT Portfolio,3.0.5 and below,Other
BT Portfolio,3.0.5 and below,Other Resolution: update to 3.0.6 or later Update notice: http://bowthemes.com/bt-portfolio-version-3.0.6.4.6-released.html...
Art Pretty Photo [artprettyphoto],1.9.21 and below,XSS (Cross Site Scripting)
Art Pretty Photo artprettyphoto, 1.9.21 and below, XSS Cross Site Scripting...
BeestoHelpDesk, 3.1.1 and probably all previous,Information Disclosure
BeestoHelpDesk, 3.1.1 and probably all previous,Information Disclosure Resolution: update to version 3.1.2 or 2.5.2 for users of Joomla 2.5.x update notice: http://beesto.com/forum/read.php?25,1963,1963msg-1963...
Kunena,3.0.7 and previous
Kunena,3.0.7 and previous,Other Resolution: update to 3.0.8 Update notice url: http://www.kunena.org/blog/143-kunena-3-0-8-released Note that the developer did not inform the VEL...
JCE - Joomla Content Editor 2.4.5 and previous
Versions 2.4.5 and previous Update to Version 2.4.6 improves security in add-on installation system UpdateNoticeURL https://www.joomlacontenteditor.net/news/item/jce-246-released...
edocuman, 1.6.0, Other
edocuman, 1.6.0, Other Developer update notice http://joomdonation.com/forum/edocman/45095-low-security-edocman-1-6-1-released.html53433...
Watchful Client (watchful.li extension), 1.9.0 and lower
Extension was not preventing execution of files outside of the framework, and therefore enabling potential unwanted information disclosure and other attacks using weak hash key implementation. Update to version 1.9.1 : https://watchful.li/news/watchful-1-9-1-released.html...
iRecommend, >= 3.0,
iRecommend, = 3.0, Other XSS & FPD developer states inaccurate report...
Spider contacts, 1.3.3,
Spider contacts, 1.3.3, SQL Injection Extension Update Details We have fixed the vulnerability on Spider Contacts. We have changed the version to 1.3.4 on JED and also added corresponding text to the description. UpdateNoticeURL http://web-dorado.com/products/joomla-contacts.html...
Mijo Analytics, Joomla 2.5.x,
Mijo Analytics, Joomla 2.5.x, SQL Injection...
[20100423] - Core - Negative Values for Limit and Offset
If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system...
Phoca Guestbook, , Other
https://www.phoca.cz/...
[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints
An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...
[20260501] - Core - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules...
LazyDbBackup, 3.9.0, Other
LazyDbBackup Version: 4.0.8...
Virtual Classroom, , SQL Injection
Developer release blog https://blog.braincert.com/virtual-classroom-security-release-elevate-your-online-learning-on-wordpress-and-joomla/...