[20111001] - Core - Information Disclosure

Weak encryption causes potential information disclosure...

[20110602] - Information Disclosure

Inadequate filtering causes possible information disclosure...

[20090602] - Core - ja_purity XSS

A XSS vulnerability exists in the JAPurity template which ships with Joomla! 1.5...

[20260520] - Framework - Inadequate content filtering within the cleanAttributes filter code

Lack of input filtering leads to an XSS vector in the HTML filter code...

[20260519] - Framework - Inadequate content filtering within the checkAttribute filter code

Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components...

[20260101] - Core - Inadequate content filtering for data URLs

Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags...

Advanced custom fields, 2.7.7, SQL Injection

Version: Old 2.8.2 / New 2.8.3 Update details: Improved sanitization/escaping of custom field values in v2.8.3 Update URL: https://www.tassos.gr/releases/advanced-custom-fields/advanced-custom-fields-2-8-3?format=htmlChangelog...

LazyDbBackup, 3.9.0, Other

LazyDbBackup Version: 4.0.8...

JomSocial , 4.7.6, XSS (Cross Site Scripting)

JomSocial , 4.7.6, XSS Cross Site Scripting investigation...

publisher, 3.0.19, XSS (Cross Site Scripting)

ijoomlapublisher, 3.0.19, XSS Cross Site Scripting...

music collection, 3.0.3 ,SQL Injection

music collection, 3.0.3 ,SQL Injection Developer statement: currently at version 3.0.6, this was already fixed in 3.0.4...

Forms by Balbooa.com,1.7.2,Information Disclosure

Forms by Balbooa.com,1.7.2,Information Disclosure Resolution: update to 1.7.4 there was a previous update 1.7.3 which did not entirely fix the issue update notice: https://support.balbooa.com/forum/joomla-forms/5441-balbooa-joomla-forms-v-1-7-4...

JS Jobs, 1.1.9, SQL Injection

JS Jobs by Joomsky, versions 1.1.9 and previous, SQL injection resolution: update to version 1.2.0 update notice: http://www.joomsky.com/products/js-jobs.html...

JS Support Ticket 1.1.0, ,XSS (Cross Site Scripting)

JS Support Ticket 1.1.0, ,XSS Cross Site Scripting UpdateNotice URL 1.1.1 http://www.joomsky.com/products/js-ticket-joomla.html...

En Masse, all versions, SQL Injection

En Masse by Matamko.com, all known versions, SQL Injection...

JS Jobs,1.1.8, RCE

JS Jobs, 1.1.8, Remote code execution - includes free and pro versions resolution: update to 1.1.9 update notice: http://www.joomsky.com/products/js-jobs.html...

KissGallery 1.0.0, SQL Injection

KissGallery version 1.0.0 by TW Carter, SQL Injection...

BookLibrary,3.6.14,SQL Injection

BookLibrary by Ordasoft, 3.6.14, SQL Injection Resolutiion: Update to 3.6.15 Update notice: http://ordasoft.com/News/News/book-library-security-update.html...

community quiz,4.4.1,SQL Injection

community quiz by corejoomla.com, 4.4.1, SQL Injection Resolution: update to 4.4.2 Update Notice: https://www.corejoomla.com/news/1164-community-quiz-v4-4-2-is-released.html...

guesser, 1.0.4

guesser by bitsgeo.com, 1.0.4, SQL Injection...

Community Builder versions 2.1 and previous

Community Builder Versions 2.1.0 and previous contain versions of 3rd party libraries with known vulnerabilities: PHPMailer and Guzzle Release 2.1.1 updates to version 5.2.22 of PHP Mailer provides custom fix for Guzzle library Developer states that this is precautionary only, and that these...

DT Register, sql/xss, 3.1.12 / 2.8.18 and previous

DT Register Vulnerable version: 3.1.12 / 2.8.18 and previous sql/xss http://www.dthdevelopment.com/dth-news/dt-register-3.1.13-security-release.html http://www.dthdevelopment.com/joomla-components/dt-register-event-registration-for-joomla.html developer did not inform VEL...

Realtyna RPL,8.9.2,Other

Realtyna RPL,8.9.2,Other Resolution: update to 8.9.5 Update notice URL http://rpl.realtyna.com/Change-Logs/RPL7-Changelog...

JCE - A Content Editor for Joomla, 2.5.0, 2.5.1, 2.5.2

JCE - A Content Editor for Joomla, vulnerable versions: 2.5.0, 2.5.1, 2.5.2, Vulnerability type: other Resolution: update to version 2.5.3 Update Notice URL https://www.joomlacontenteditor.net/news/item/jce-253-released Developer says that versions prior to 2.5.0 do not appear to be affected, but...

UMI 3D Tag Cloud [mod_umi3dtagcloud], 1.3.4 and below, XSS (Cross Site Scripting)

UMI 3D Tag Cloud modumi3dtagcloud, 1.3.4 and below, XSS Cross Site Scripting...

joomla spider video, 2.8.3, sqli

joomla spider video, 2.8.3, SQL Injection UpdateNoticeURL http://web-dorado.com/products/joomla-player.html...

Akeeba backup

https://www.akeebabackup.com/home/news/1561-security-updates-august-2014.html 3.2.0-3.2.7, 3.3.0-3.3.13, 3.4.0-3.4.3, 3.5.x, 3.6.0-3.6.12, 3.7.x, 3.8.0-3.8.2, 3.9.x, 3.10.x, 3.11.0-3.11.3...

JChatSocial, 2.2 and lower

JChatSocial, 2.2 and lower, XSS Cross Site Scripting...

JW player, 5.10.22 xss

JW player, 5.10.2295, XSS Cross Site Scripting Update notice url:http://www.joomlaworks.net/forum/extension-updates/14896-june-3rd,-2014-allvideos-v4-6-0...

JomSocial component pre 3.1.0.1

JomSocial component 3.1.0.1 RFI The new version number is 3.1.0.4 http://www.jomsocial.com/blog/hot-fix-3-1-0-4...

Spider contacts, 1.3.3,

Spider contacts, 1.3.3, SQL Injection Extension Update Details We have fixed the vulnerability on Spider Contacts. We have changed the version to 1.3.4 on JED and also added corresponding text to the description. UpdateNoticeURL http://web-dorado.com/products/joomla-contacts.html...

Mijo Analytics, Joomla 2.5.x,

Mijo Analytics, Joomla 2.5.x, SQL Injection...

Jinc, ALL,

Jinc ALL - Exploit Type Arbitrary File Creation Vulnerability JINC until version 1.0.1 is affected by a vulnerability providing attackers the ability to update arbitrary files in Joomla! installation. This problem is solved in JINC 1.0.2...

worldrates

http://dev.pucit.edu.pk/120410 Authors:...

[20120306] - Core - Information Disclosure

Inadequate permission checking allows unauthorised viewing of administrative back end information...

[20111003] - Core - Information Disclosure

Weak encryption causes potential information disclosure...

[20110901] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in comsearch...

[20100423] - Core - Negative Values for Limit and Offset

If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system...

[20080903] - Core - com_mailto Spam

The mailto component does not verify validity of the URL prior to sending...

Phoca Guestbook, , Other

https://www.phoca.cz/...

[20260516] - Core - Incorrect Access Control in com_scheduler

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks...

[20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

Virtual Classroom, , SQL Injection

Developer release blog https://blog.braincert.com/virtual-classroom-security-release-elevate-your-online-learning-on-wordpress-and-joomla/...

xcloner,3.53,Other

xcloner,3.53,Other Developer statement Today we have made available a new release — version 3.5.4 — for the unmaintained Joomla version of XCloner. Prior versions of XCloner for Joomla contained an Authenticated Local File Disclosure vulnerability that has been patched in the latest version. Any...

GMapFP 3.30,Other

GMapFP 3.30,3.30,Other Related in https://vel.joomla.org/resolved/1835-gmapfp-3-39f-xss-cross-site-scripting new version number 3.55...

JS support ticket,1.1.6, SQL Injection

JS support ticket,1.1.6, SQL Injection resolution: update to 1.1.7 update notice: https://joomsky.com/products/js-ticket-joomla.html...

eXtplorer 2.1.12 various

eXtplorer 2.1.12 various Update Notice URL https://extplorer.net/news/24...

kunena, ,XSS (Cross Site Scripting)

kunena,5.1.3,XSS Cross Site Scripting...

Jimtawl, 2.2.6, Arbitrary File Upload

Jimtawl from janguo.de, 2.2.6, arbitrary file upload Resolution: update to 2.2.7 Update notice: http://janguo.de/lang-de/joomla-25-higher/jimtawl.html...

Joomla Guru, SQL Injection

Joomla Guru by IJoomla, 5.0.15 and previous, SQL Injection resolution: update to 5.0.16 update notice: https://guru.ijoomla.com/changelog/237-guru-5-0-16...