751 matches found
Joomla Guru, SQL Injection
Joomla Guru by IJoomla, 5.0.15 and previous, SQL Injection resolution: update to 5.0.16 update notice: https://guru.ijoomla.com/changelog/237-guru-5-0-16...
JEXTN Video Gallery 3.0.5 - SQL Injection, 3.0.5 ,SQL Injection
JEXTN Video Gallery 3.0.5 - SQL Injection, 3.0.5 ,SQL Injection...
Checklist by Joomplace,1.1.0,SQL Injection
Checklist by Joomplace, 1.1.0, SQL Injection Resolution: update to 1.1.1 Update notice: https://www.joomplace.com/blog/checklist-security-update.html...
Payplans 3.6.2
Payplans 3.6.2 and previous, price manipulation resolution: update to 3.6.3 update notice: https://stackideas.com/blog/critical-update-for-payplans-363...
Simgenealogy,2.1.7,SQL Injection
Simgenealogy by Simbunch.com, 2.1.7 and previous, SQL Injection resolution: update to 2.1.8 update notice: https://www.simbunch.com/blog/183-simgenealogy-critical-security-update-2-1-8...
User Group FTW For Hikashop,1.1.5,Other
User Group FTW For Hikashop, 1.1.5, Other...
Joomla GoogleSearch (CSE), 3.0.2 and below, any Joomla
Joomla GoogleSearch CSE, 3.0.2 and below, any Joomla, XSS Cross Site Scripting Resolution: update to version 3.0.4 Update Notice: http://www.kksou.com/php-gtk2/joomla-news/important-notice-googlesearch-cse-component.php...
J2Store by Weblogicx India, 3.1.6 and below, SQL Injections
J2Store by Weblogicx India, 3.1.6 and below, SQL Injections Update: vulnerabilites fixed in version 3.1.7 Announcement: http://j2store.org/j2store-v3.html...
StarLite Pretty Photo [plg_system_slprettyphoto],1.2, XSS (Cross Site Scripting)
StarLite Pretty Photo plgsystemslprettyphoto, 1.2 and below, XSS Cross Site Scripting...
ECommerce-WD [com_ecommercewd],1.2.5, maybe earlier
ECommerce-WD comecommercewd,1.2.5, maybe earlier,SQL Injection developer statement This vulnerabilities are fixed in version 1.2.6 and above. The version 1.2.6 was released on 2015-03-18...
Joomla Simple Photo Gallery version 1.1
Apptha Joomla Simple Photo Gallery ,comsimplephotogallery version 1.1 and previous, Other...
corephp paGo, LFI 1.0.7 and below
Corephp paGo, , DT, LFI Developer update statement http://www.corephp.com/blog/corephp-announces-immediate-availability-pago-commerce-1-07-1/...
failedloginattempts v1.0.1
plgfailedloginattemptsv1.0.1j25j30, 1.0.1, Information Disclosure Developers update statements 12-Dec-2014 : v1.1.0 http://www.web357.eu/news/releases/68-failed-login-attempts-v1-1-0-has-been-released-security-release.html...
HDFLVPlayer, 2.0, Directory Traversal
HDFLVPlayer, 2.0, Directory Traversal Contus/apptha developers statement We fixed the directory traversal issue and updated the version with 2.2 UpdateNoticeURL http://www.hdflvplayer.net/hd-flv-player-download.php...
K2 Content Extension, 2.6.8,
K2 Content Extension, 2.6.8, XSS Cross Site Scripting resolution update to version 2.6.9...
[20140303] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability...
[20140302] - Core - XSS Vulnerability
Inadequate escaping leads to XSS vulnerability in comcontact...
[20140304] - Core - Unauthorised Logins
Inadequate checking allowed unauthorised logins via GMail authentication...
ODude Profile
ODude Profile Directory Traversal vulnerability - 777 developer statement ODude Profile | 3.2 | http://www.odude.com/main/profile/profile-changelog.html ---|---|---...
[20131101] Core XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in comcontact...
event registration pro
event registration pro, , SQL Injection UpdateNoticeURL: http://www.joomlashowroom.com/blog/security-and-bug-release-for-all-versions-of-event-registration-pro affects versions prior to 3.0.1 Joomla 3 prior to 2.5.6 Joomla 2.5 prior to 1.5.22 Joomla 1.5...
Master Password,
Master Password, 1.5 and any previous, Information Disclosure This extension appears to have been abandoned by the developer...
alfcontact
xss 230413...
[20080904] - Core - Redirect Spam
Several components utilize a passed in URL to redirect to after processing. These URLs are not validated prior to the redirect. A crafted URL can cause the system to redirect to a spam or phishing site...
[20260512] - Core - MFA Authentication Bypass
Incorrectly resetted session states to a vector that allows to bypass 2FA checks...
Novarain/Tassos Framework, , SQL Injection
allow SQL injection and unauthenticated file reads. Attackers can chain these issues for administrator takeover and remote code execution on unpatched systems. Affected extensions include Convert Forms, EngageBox, Google Structured Data, Advanced Custom Fields, and Smile Pack, all relying on the...
js jobs, 1.3, SQL Injection
js jobs,1.3,SQL Injection...
hwdplayer,4.2,SQL Injection
hwdplayer,4.2,SQL Injection Possible abandonware also...
J2Store, 3.3.9. and previous,XSS (Cross Site Scripting)
J2Store,3.9.x,XSS Cross Site Scripting Update to 3.3.11 https://www.j2store.org/blog/general/j2store-3-3-11-released-with-improvements-and-a-security-fix.html...
RSEvents! Pro (March 2019),Other
RSEvents! Pro March 2019,Other new version number 2.2.1 UpdateNotice URL https://www.rsjoomla.com/blog/view/468-csv-vulnerability-explained.html...
RSEvents! Pro Cart Plugin older than 1.1.15 ,Other
RSEvents! Pro Cart Plugin older than 1.1.15,Other UpdateNotice URL https://www.rsjoomla.com/blog/view/468-csv-vulnerability-explained.html...
RSMembership! older than 1.22.11 ,Other
RSMembership! older than 1.22.11,Other UpdateNotice URL https://www.rsjoomla.com/blog/view/468-csv-vulnerability-explained.html...
[20190502] - Core - By-passing protection of Phar Stream Wrapper Interceptor
In Joomla 3.9.3, the vulnerability of insecure deserialization when executing Phar archives was addressed by removing the known attack vector in the Joomla core. In order to intercept file invocations like fileexists or stat on compromised Phar archives the base name has to be determined and...
TCPDF Library,6.2.12,Other
TCPDF Library,6.2.12,Other updated to v6.2.26 | ---|--- ttweetfsubscribe...
JoomCRM 1.1.1
new version number 1.1.2 https://www.joomboost.com/blog-updates/joomcrm-version-1-1-2-security-announcement.html...
Jomres,9.14.0 & lower,Other
Jomres,9.14.0 & lower Developer statement new version number 9.15.0 UpdateNotice URL https://www.jomres.net/blog/99-jomres-9-15-0-security-release-new-features Changelog Url https://www.jomres.net/support/changelog...
My Projects,2.0,SQL Injection
My Projects,2.0,SQL Injection Resolution: update to version 2.1 Update notice: http://www.gegabyte.org/downloads/joomla-extensions/joomla3/components/292-my-projects...
Bargain Product VM3, 1.0, SQL Injection
Bargain Product VM3 by WebOrange, 1.0, SQL Injection...
Realtyna RPL, All versions, SQL Injection and Abandonware
Realtyna RPL, All versions, SQL Injection and abandonware The developer no longer supports Joomla! The site is still online, but there are redirects to the Wordpress version. We asked the developer about the prospect of a security release, and received this reply: It’s almost 2 years that we...
IJSEO, 3.1.17, SQL Injection
IJSEO from IJoomla, 3.1.17, SQL Injection Resolution: update to 3.1.18 Update notice: https://seo.ijoomla.com/blog/entry/joomla-iseo-extension-got-important-security-fix-1-1 The issue affects both the commercial Pro and the non-commercial Light versions of the extension. The developer released a...
easysocial, 2.0.18 and below
easysocial, 2.0.18 and below Extension Update Details https://stackideas.com/blog/security-update-for-easysocial-2019...
AppointmentBookingPro,4.0.1,SQL Injection
AppointmentBookingPro, 4.0.1, SQL Injection Resolution: update to 4.0.2 RC2 Update notice: https://appointmentbookingpro.com/support2/an2/17169-joomla-vel.html...
Most Wanted Real Estate,1.1.0,SQL Injection
Most Wanted Real Estate, 1.1.0, SQL Injection...
Alta User Points,1.1.7,SQL Injection
Alta User Points, 1.1.7, SQL Injection Resolution: update to 1.1.8 Update Notice URL https://www.nordmograph.com/extensions/index.php?option=comvirtuemart=productdetailsproductid=120categoryid=8=58...
Ajax search for K2, 2.2
Ajax search for K2 by taleia.software, 2.2, SQL Injection...
Jtag Calendar 6.2.4
JTag Calendar versions 6.2.4 and previous Resolution: update to 6.2.5 Developer states: Fixed security issue in search functionality Update notice: https://joomlatag.com/premium-joomla-extensions/jtag-calendar-detail.html...
[20161204] - Misc. Security Hardening
Joomla! 3.6.5 includes additional security hardening mechanisms prepared by the JSST, thanks in part to issue reports from Fotis Evangelou and Nicholas Dionysopoulos, which restricts a user's ability to make potentially damaging configuration changes. This includes restricting the ability to set...
JSN Power Admin,2.3.0,XSS (Cross Site Scripting)
JSN Power Admin,2.3.0, XSS Cross Site Scripting Resolution: update to 2.3.2 Update notice: http://www.joomlashine.com/knowledgeportal/articles/jsn-poweradmin-vulnerability-problem-solved.html Note that previous security release 2.3.1 is still vulnerable, and should be updated...
Komento, 2.0.4 and previous, XSS (Cross Site Scripting)
Stackideas Komento, prior to 2.0.5, XSS Cross Site Scripting Resolved in version 2.0.5 Update notice: http://stackideas.com/changelog/komento?version=2.0.5...