Membership Pro and other OS Solution extensions

Os Solution products have fixed an issue in the Paypal payment gateway in five of their extensions and made new releases to fix it:- 1. Events Booking version 2.14.2 https://www.joomdonation.com/forum/events-booking-general-discussion/57320-events-booking-version-2-14-2-released.html 2...

BookLibrary,3.6.14,SQL Injection

BookLibrary by Ordasoft, 3.6.14, SQL Injection Resolutiion: Update to 3.6.15 Update notice: http://ordasoft.com/News/News/book-library-security-update.html...

Canonical Url,4.1.1,SQL Injection

Canonical Url by CMSPlugin.com, 4.1.1, SQL Injection Resolution: update to 4.2.1 Update notice: https://www.cmsplugin.com/products/components/4-canonical-url...

Abstract manager, 2.1

Abstract manager by joomla6teen.com, 2.1, SQL Injection...

Community Builder versions 2.1 and previous

Community Builder Versions 2.1.0 and previous contain versions of 3rd party libraries with known vulnerabilities: PHPMailer and Guzzle Release 2.1.1 updates to version 5.2.22 of PHP Mailer provides custom fix for Guzzle library Developer states that this is precautionary only, and that these...

AVChat Video Chat Integration Kit, File permissions

AVChat Video Chat Integration Kit, File permissions...

[20161204] - Misc. Security Hardening

Joomla! 3.6.5 includes additional security hardening mechanisms prepared by the JSST, thanks in part to issue reports from Fotis Evangelou and Nicholas Dionysopoulos, which restricts a user's ability to make potentially damaging configuration changes. This includes restricting the ability to set...

[20160802] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in mail component...

EasySocial versions before 1.4.7

EasySocial versions before 1.4.7: Code injection Resolution: update to 1.4.7 Update notice: http://stackideas.com/blog/critical-update-for-easysocial-update-to-1-4-7-now...

Escope PrettyPhoto [mod_escope_pp], 1.0.3, XSS (Cross Site Scripting) - abandonware!

Escope PrettyPhoto modescopepp, 1.0.3 and below, XSS Cross Site Scripting...

BeestoHelpDesk, 3.1.1 and probably all previous,Information Disclosure

BeestoHelpDesk, 3.1.1 and probably all previous,Information Disclosure Resolution: update to version 3.1.2 or 2.5.2 for users of Joomla 2.5.x update notice: http://beesto.com/forum/read.php?25,1963,1963msg-1963...

Face Gallery by Apptha [com_facegallery] version 1.0

Face Gallery by Apptha comfacegallery, version 1.0 exploit: Other...

J2Store 2.5 to 2.8.3, SQL Injection

J2Store 2.5 to 2.8.3 SQL Injection Update to 2.8.4 UpdateNoticeURL http://j2store.org/blog/213-security-update-january-2015.html...

JCE - Joomla Content Editor 2.4.5 and previous

Versions 2.4.5 and previous Update to Version 2.4.6 improves security in add-on installation system UpdateNoticeURL https://www.joomlacontenteditor.net/news/item/jce-246-released...

corephp paGo, LFI 1.0.7 and below

Corephp paGo, , DT, LFI Developer update statement http://www.corephp.com/blog/corephp-announces-immediate-availability-pago-commerce-1-07-1/...

Admin Exile 2.3.5 sqli

Admin Exile version 2.3.5 SQL injection Developer Update Version 2.3.6 resolves an unpublished/theoretical SQL injection vulnerability. http://www.richeyweb.com/development/joomla-plugins/71-adminexile-for-joomla-16...

Akeeba CMS Update

Extension Update Details Akeeba CMS Update 1.0.2 Update Notice URL https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html...

JDownloads

unauthorized file upload vulnerable versions: below 1.9.1.6 Joomla 2.5 and below 1.9.2.11 Joomla 3 security release announcement: http://www.jdownloads.com/index.php?option=comcontent=article=231:urgent-security-update-for-19-series=51:news Note that the developer did not inform the VEL...

plg_highlight_content, 1.5 and previous

plghighlightcontent, 1.5 and previious versions, XSS Cross Site Scripting update notice: http://www.jonijnm.es/web/descargas/category/9-highlight-code.html...

[20140303] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability...

iRecommend, >= 3.0,

iRecommend, = 3.0, Other XSS & FPD developer states inaccurate report...

Spider contacts, 1.3.3,

Spider contacts, 1.3.3, SQL Injection Extension Update Details We have fixed the vulnerability on Spider Contacts. We have changed the version to 1.3.4 on JED and also added corresponding text to the description. UpdateNoticeURL http://web-dorado.com/products/joomla-contacts.html...

[20131103] Core XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in comcontact...

event registration pro

event registration pro, , SQL Injection UpdateNoticeURL: http://www.joomlashowroom.com/blog/security-and-bug-release-for-all-versions-of-event-registration-pro affects versions prior to 3.0.1 Joomla 3 prior to 2.5.6 Joomla 2.5 prior to 1.5.22 Joomla 1.5...

Mijo Analytics, Joomla 2.5.x,

Mijo Analytics, Joomla 2.5.x, SQL Injection...

CiviCRM 4.3.3 and previous

CiviCRM, = 4.3.3, XSS Cross Site Scripting Update Notice URL http://civicrm.org/blogs/colemanw/security-release-civicrm-434...

[20120202] - Core - Information Disclosure

On some servers the error log could be read by unauthorised users...

[20110701] - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability...

[20090102] - Core - plg_xstandard Directory Traversal

A crafted request can cause disclosure of the directory structure on the server including any directory that php has access to...

[20080903] - Core - com_mailto Spam

The mailto component does not verify validity of the URL prior to sending...

[20260301] - Core - ACL hardening in com_ajax

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers...

EasyDiscuss by Stackideas,, , SQL Injection

EasyDiscuss by Stackideas,, , SQL Injection...

Phoca commander

Name: Phoca Company: - Email: [email protected] Extension: Phoca Commander Version: Old 4.0.0, 5.0.1 / New 4.0.2, 5.0.3 Update details: No access for unzip feature as default Update URL: https://github.com/PhocaCz/PhocaCommander/releases/tag/5.0.2 Changelog URL: Download URL:...

JS Jobs extension (v1.4.2)

JS Jobs extension v1.4.2 sqli...

[20250901] - Core - Inadequate content filtering within the checkAttribute filter code

Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components...

LazyDbBackup, 3.9.0, Other

LazyDbBackup Version: 4.0.8...

Virtual Classroom, , SQL Injection

Developer release blog https://blog.braincert.com/virtual-classroom-security-release-elevate-your-online-learning-on-wordpress-and-joomla/...

xcloner,3.53,Other

xcloner,3.53,Other Developer statement Today we have made available a new release — version 3.5.4 — for the unmaintained Joomla version of XCloner. Prior versions of XCloner for Joomla contained an Authenticated Local File Disclosure vulnerability that has been patched in the latest version. Any...

hwdplayer,4.2,SQL Injection

hwdplayer,4.2,SQL Injection Possible abandonware also...

J2Store, 3.3.9. and previous,XSS (Cross Site Scripting)

J2Store,3.9.x,XSS Cross Site Scripting Update to 3.3.11 https://www.j2store.org/blog/general/j2store-3-3-11-released-with-improvements-and-a-security-fix.html...

eXtplorer 2.1.12 various

eXtplorer 2.1.12 various Update Notice URL https://extplorer.net/news/24...

RSEvents! Pro Cart Plugin older than 1.1.15 ,Other

RSEvents! Pro Cart Plugin older than 1.1.15,Other UpdateNotice URL https://www.rsjoomla.com/blog/view/468-csv-vulnerability-explained.html...

TCPDF Library,6.2.12,Other

TCPDF Library,6.2.12,Other updated to v6.2.26 | ---|--- ttweetfsubscribe...

Kunena,5.1.9,XSS (Cross Site Scripting)

Kunena,5.1.9,XSS Cross Site Scripting https://www.kunena.org/blog/203-kunena-5-1-10-released...

JoomCRM 1.1.1

new version number 1.1.2 https://www.joomboost.com/blog-updates/joomcrm-version-1-1-2-security-announcement.html...

kunena,5.1.6.1,XSS (Cross Site Scripting)

kunena,5.1.6.1,XSS Cross Site Scripting Developer statement: Update to 5.1.7 https://www.kunena.org/blog/200-kunena-5-1-7-released...

Forms by Balbooa.com,1.7.2,Information Disclosure

Forms by Balbooa.com,1.7.2,Information Disclosure Resolution: update to 1.7.4 there was a previous update 1.7.3 which did not entirely fix the issue update notice: https://support.balbooa.com/forum/joomla-forms/5441-balbooa-joomla-forms-v-1-7-4...

JBuildozer,1.4.1,SQL Injection

JBuildozer,1.4.1,SQL Injection...

Zap Calendar, 4.3.6 and previous, SQL Injection

Zap Calendar, 4.3.6, SQL Injection resolution: update to 4.3.7 update notice url: https://zcontent.net/support/zapcalendar/265-change-log-for-zap-calendar...

HikaShop Business,3.1.0,SQL Injection

HikaShop Business,3.1.0,SQL Injection new version number 3.1.1 Update Notice URL https://www.hikashop.com/home/blog/373-security-release-for-hikashop-business.html...