761 matches found
CW Article Attachments (Free Version), SQL Injection
CW Article Attachments Free Version from cwjoomla.com, versions 1.0.6 and previous, SQL Injection resolution: update to 1.0.7 update notice: http://www.cwjoomla.com/download-cw-article-attachments...
JB Visa,1.0,SQL Injection
JB Visa by Joombooking.com, 1.0, SQL Injection...
B2j Contact,2.0 and other,Other
B2j Contact,2.0 and other,Other Resolved by upgrading to 2.1.15...
HDW Player,4.0.0, RCE
HDW Player,4.0.0 and all other versions, remote code execution Note that this vulnerabilitiy was supposedly fixed by the developer in version 3.2.2, the fact that this issue has arisen again suggests that the developer is aware of it and has created a deliberate back door. The VEL believe that th...
Zap Calendar, 4.3.6 and previous, SQL Injection
Zap Calendar, 4.3.6, SQL Injection resolution: update to 4.3.7 update notice url: https://zcontent.net/support/zapcalendar/265-change-log-for-zap-calendar...
guesser, 1.0.4
guesser by bitsgeo.com, 1.0.4, SQL Injection...
HDW Player, 3.2.1 and older
HDW Player, 3.2.1 and older including 3.1 and 3.0 Remote code execution Please see https://vel.joomla.org/vel-blog/2033-hdw-player-4-0-0-rce for further information...
ja-k2- filter-and- search, SQL Injection
ja-k2- filter-and- search, version 1.2.2 and all previous SQL Injection Resolution: update to 1.2.5 Update notice: https://www.joomlart.com/updates/joomla-extensions/important-security-fix-release-ja-k2-filter-component?utmsource=newslettermedium=emailcampaign=k2filtercritical Note that developer...
Komento 2.0.6, xss
We just released Komento 2.0.7 to address a security issue where a remote attacker may be able to launch an xss attack in prior versions of Komento. update notice: https://stackideas.com/blog/important-komento-2-0-7-security-fix...
EasySocial versions before 1.4.7
EasySocial versions before 1.4.7: Code injection Resolution: update to 1.4.7 Update notice: http://stackideas.com/blog/critical-update-for-easysocial-update-to-1-4-7-now...
Event Manager, 2.1.4 and below, multiple vulnerabilities
Event Manager, 2.1.4 and below, SQLi and Unrestricted File Upload Fixed in version 2.1.4.2 Notice: http://www.joomlaeventmanager.net/project/changelog-jem-2...
Football [com_football],SQL Injection
Component comfootball, unknown version possibly joomleague fork SQL Injection...
Face Gallery by Apptha [com_facegallery] version 1.0
Face Gallery by Apptha comfacegallery, version 1.0 exploit: Other...
youtube plugin - youtubejoomla ,1.1
youtube plugin - Stian Totland,1.1 ,Other , youtubejoomla...
joomla spider video, 2.8.3, sqli
joomla spider video, 2.8.3, SQL Injection UpdateNoticeURL http://web-dorado.com/products/joomla-player.html...
[20131101] Core XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in comcontact...
event registration pro
event registration pro, , SQL Injection UpdateNoticeURL: http://www.joomlashowroom.com/blog/security-and-bug-release-for-all-versions-of-event-registration-pro affects versions prior to 3.0.1 Joomla 3 prior to 2.5.6 Joomla 2.5 prior to 1.5.22 Joomla 1.5...
jomsocial below 3.0.5.1
jomsocial , 3.0.5.1, SQL Injection Resolved prior to notification...
[20131102] Core XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in comcontact, comweblinks, comnewsfeeds...
alfcontact
xss 230413...
worldrates
http://dev.pucit.edu.pk/120410 Authors:...
[20120902] - Core - XSS Vulnerability
Inadequate escaping of output leads to XSS vulnerability in language switcher module...
[20111003] - Core - Information Disclosure
Weak encryption causes potential information disclosure...
[20111001] - Core - Information Disclosure
Weak encryption causes potential information disclosure...
[20090102] - Core - plg_xstandard Directory Traversal
A crafted request can cause disclosure of the directory structure on the server including any directory that php has access to...
[20080903] - Core - com_mailto Spam
The mailto component does not verify validity of the URL prior to sending...
[20260711] - Core - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access comprivacy datasets...
[20260513] - Core - Privilege escalation through com_users batch task
An improper access check allows privlege escalation through the comusers batch task...
[20260512] - Core - MFA Authentication Bypass
Incorrectly resetted session states to a vector that allows to bypass 2FA checks...
[20260501] - Core - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules...
Novarain/Tassos Framework, , SQL Injection
allow SQL injection and unauthenticated file reads. Attackers can chain these issues for administrator takeover and remote code execution on unpatched systems. Affected extensions include Convert Forms, EngageBox, Google Structured Data, Advanced Custom Fields, and Smile Pack, all relying on the...
JomSocial , 4.7.6, XSS (Cross Site Scripting)
JomSocial , 4.7.6, XSS Cross Site Scripting investigation...
eXtplorer 2.1.12 various
eXtplorer 2.1.12 various Update Notice URL https://extplorer.net/news/24...
RSEvents! Pro (March 2019),Other
RSEvents! Pro March 2019,Other new version number 2.2.1 UpdateNotice URL https://www.rsjoomla.com/blog/view/468-csv-vulnerability-explained.html...
Forms by Balbooa.com,1.7.2,Information Disclosure
Forms by Balbooa.com,1.7.2,Information Disclosure Resolution: update to 1.7.4 there was a previous update 1.7.3 which did not entirely fix the issue update notice: https://support.balbooa.com/forum/joomla-forms/5441-balbooa-joomla-forms-v-1-7-4...
En Masse, all versions, SQL Injection
En Masse by Matamko.com, all known versions, SQL Injection...
JBuildozer,1.4.1,SQL Injection
JBuildozer,1.4.1,SQL Injection...
HikaShop Business,3.1.0,SQL Injection
HikaShop Business,3.1.0,SQL Injection new version number 3.1.1 Update Notice URL https://www.hikashop.com/home/blog/373-security-release-for-hikashop-business.html...
Extra Search by Joomlaboat,2.2.8 and previous,SQL Injection
Extra Search by Joomlaboat, 2.2.8 and previous, SQL Injection...
community quiz,4.4.1,SQL Injection
community quiz by corejoomla.com, 4.4.1, SQL Injection Resolution: update to 4.4.2 Update Notice: https://www.corejoomla.com/news/1164-community-quiz-v4-4-2-is-released.html...
Abstract manager, 2.1
Abstract manager by joomla6teen.com, 2.1, SQL Injection...
[20161204] - Misc. Security Hardening
Joomla! 3.6.5 includes additional security hardening mechanisms prepared by the JSST, thanks in part to issue reports from Fotis Evangelou and Nicholas Dionysopoulos, which restricts a user's ability to make potentially damaging configuration changes. This includes restricting the ability to set...
Huge IT Video Gallery,1.1.1,XSS (Cross Site Scripting)
Huge IT Video Gallery,1.1.1,XSS Cross Site Scripting Also versions 1.0.9 and previous have SQL injection vulnerability Resolution: update to version 1.1.3 Update notice: https://huge-it.com/joomla-extensions-security-notice/...
[20160802] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability in mail component...
JCE - A Content Editor for Joomla, 2.5.0, 2.5.1, 2.5.2
JCE - A Content Editor for Joomla, vulnerable versions: 2.5.0, 2.5.1, 2.5.2, Vulnerability type: other Resolution: update to version 2.5.3 Update Notice URL https://www.joomlacontenteditor.net/news/item/jce-253-released Developer says that versions prior to 2.5.0 do not appear to be affected, but...
UMI 3D Tag Cloud [mod_umi3dtagcloud], 1.3.4 and below, XSS (Cross Site Scripting)
UMI 3D Tag Cloud modumi3dtagcloud, 1.3.4 and below, XSS Cross Site Scripting...
Escope PrettyPhoto [mod_escope_pp], 1.0.3, XSS (Cross Site Scripting) - abandonware!
Escope PrettyPhoto modescopepp, 1.0.3 and below, XSS Cross Site Scripting...
ECommerce-WD [com_ecommercewd],1.2.5, maybe earlier
ECommerce-WD comecommercewd,1.2.5, maybe earlier,SQL Injection developer statement This vulnerabilities are fixed in version 1.2.6 and above. The version 1.2.6 was released on 2015-03-18...