JEXTN Question And Answer ,3.1.0,SQL Injection

JEXTN Question And Answer ,3.1.0,SQL Injection...

Virtuemart,3.2.4,XSS (Cross Site Scripting)

Virtuemart,3.2.4,XSS Cross Site Scripting Resolution: update to 3.2.6 update notice: http://virtuemart.net/news/482-virtuemart-3-2-6-security-release-and-overhauled-infrastructure...

Keen IT Photo Contest, 1.0.2, SQL Injection

Keen IT Photo Contest, 1.0.2, SQL Injection...

Akeeba Backup, 5.5.1, various issues

Akeeba Backup, versions 5.5.1 and previous, various issues see developer's site for details Resolution: update to 5.5.2 Update notice: https://www.akeebabackup.com/component/ars/?view=Itemsid=2732...

Kunena 5.0.8 and previous XSS

Kunena 5.0.8 and previous, cross-site scripting XSS Resolution: update to 5.0.9 Update notice: https://www.kunena.org/blog/185-kunena-5-0-9-released...

Joomla Modern Booking,1.0,SQL Injection

Joomla Modern Booking,1.0,SQL Injection new version number 2.0.0 UpdateNotice URL https://www.unikalus.com/announcements.html...

J-CruiseReservation,3.0,SQL Injection

J-CruiseReservation by CMS Junkie, 3.0, SQL Injection...

JMultipleHotelReservation, 6.0.3, SQL Injection

JMultipleHotelReservation by CMS Junkie, 6.0.3, SQL Injection Resolution: Update to 6.0.4 Update notice: http://www.cmsjunkie.com/blog/joomla-hotel-reservation-6-0-4-release/...

Smart related articles ,1.1,SQL Injection and XSS

Smart related articles by Iacopo Guarneri, 1.1,SQL Injection and XSS...

OS Services Booking,2.5.1,SQL Injection

OS Services Booking by Ossolution, 2.5.1, SQL Injection Resolution: update to 2.5.2 Update notice: https://www.joomdonation.com/forum/os-services-booking/55627-os-services-booking-2-5-2-security-announcement.html...

Real Estate Manager,3.9.7,SQL Injection

Real Estate Manager by Ordasoft, 3.9.7, SQL Injection Resolution: update to 3.9.8 Update notice: http://ordasoft.com/News/News/real-estate-manager-security-update.html...

MediaLibrary,3.5.4, SQL Injection

MediaLibrary by Ordasoft, 3.5.4, SQL Injection Resolution: update to 3.5.5 Update notice: http://ordasoft.com/News/News/media-library-security-update.html...

recipe manager, 2.2

recipe manager by joomla6teen.com, 2.2, SQL Injection...

JomWall, 4.1.1,SQL Injection

JomWall version 4.1.1 and previous, SQL Injection resolution: update to 4.1.2 update notice: https://dashbite.com/news/jomwall-security-fix-new-version-4-1-2...

Joomla Spider FAQ by Web-Dorado pre 1.3

Joomla Spider FAQ by Web-Dorado pre 1.3 ,SQLi Update to 1.3...

Easy Youtube Gallery , 1.0.2,Information Disclosure

Easy Youtube Gallery , 1.0.2,Information Disclosure...

Huge IT Catalog,1.0.6,SQL Injection

Huge IT Catalog,1.0.6 and previous versions ,SQL Injection and XSS vulnerability Resolution: update to 1.0.8 Update notice: https://huge-it.com/joomla-extensions-security-notice/...

Breezing Forms Lite

Breezing Forms Lite before build 912 Information disclosure Resolution: update to latest version Update notice: https://crosstec.org/en/blog/859-breezingforms-medium-security-update.html...

Spider random articles before 1.5.3

Spider random articles versions before 1.5.3 Resolution: update to 1.5.3 Update notice: https://web-dorado.com/products/joomla-random.html...

pPGallery [plg_content_ppgallery], 4.315, XSS (Cross Site Scripting)

pPGallery plgcontentppgallery, 4.315, XSS Cross Site Scripting...

XCloner Backup and Restore [com_cloner], 3.5.2

XCloner Backup and Restore comcloner, 3.5.2, probably previous, multiple vulnerabilities...

RD Download, 0.9.0 and below

RD Downloads comrddownload, 0.9.0 and previous Warning: Author abandoned this component, no further support expected Update notice: https://github.com/rdeutz/rddownload...

HDFLVPlayer 2.2 and previous

HDFLVPlayer versions 2.2 and all previous Email exploit Version 2.3 Fixed SQL injection in download.php file.https://www.apptha.com/category/extension/Joomla/HD-FLV-Player Version 2.2 Resolved cross domain issue in download.php & email.php files...

youtube gallery, 4.1.7,

youtube gallery, 4.1.7, SQL Injection Extension Update Details 4.1.9 UpdateNoticeURL http://www.joomlaboat.com/youtube-gallery...

My Blog, 2.0.1 Build 286,

My Blog, 2.0.1 Build 286, SQL Injection...

[20120103] - Core - Information Disclosure

Inadequate filtering leads to information disclosure...

[20111103] - Core - Password Change

Weak random number generation during password reset leads to possibility of changing a user's password...

[20260303] - Core - XSS vector in com_associations comparison view

Lack of output escaping leads to a XSS vector in the multilingual associations component...

Phoca commander

Name: Phoca Company: - Email: [email protected] Extension: Phoca Commander Version: Old 4.0.0, 5.0.1 / New 4.0.2, 5.0.3 Update details: No access for unzip feature as default Update URL: https://github.com/PhocaCz/PhocaCommander/releases/tag/5.0.2 Changelog URL: Download URL:...

[20250101] - Core - XSS vectors in module chromes

Various module chromes didn't properly process inputs, leading to XSS vectors...

kunena, 5.0.x - 5.1.14 ,XSS (Cross Site Scripting)

kunena, 5.0.x - 5.1.14 ,XSS Cross Site Scripting Developer statement https://www.kunena.org/blog/207-kunena-5-1-14-released...

Jevents 3.4.49 Various

Jevents 3.4.49 Various UpdateNotice URL https://www.jevents.net/blog/jevents-3-4-50-released-all-users-should-upgrade...

Google Maps by Reumer, 3.5, Malicious update

Google Maps by Reumer, from mapsplugin.com, version 3.5, malicious update Version 3.3 of this plugin is listed in the JED and appears to be clean. However once installed, the Joomla update manager prompts you to update this extension to a version 3.5 which is not officially published. This versio...

Price Alert for Virtuemart,3.0.4,SQL Injection

Price Alert for Virtuemart by WebOrange, 3.0.4 and all previous, SQL Injection...

LMS King Lite, SQL Injection

LMS King Lite and LMS King Professional by king-products.net, versions up to 3.2.3.19 lite and 3.2.3.47 pro, SQL Injection resolution: update to version 3.2.3.20 lite and 3.2.3.48 pro update notice url: https://www.king-products.net/lms-king.html...

OS Property,3.0.9,SQL Injection

OS Property,3.0.9,SQL Injection Resolution: update to 3.10.0 Update notice: https://www.joomdonation.com/forum/os-property/56774-os-property-3-0-9-security-announcement.html...

Vehicle Manager,3.9.4,SQL Injection

Vehicle Manager by Ordasoft,3.9.4, SQL Injection Resolution: update to 3.9.5 Update Notice URL http://ordasoft.com/News/News/vehicle-manager-security-update.html...

Huge IT gallery,1.1.5,SQL Injection

Huge IT gallery,1.1.5,SQL Injection resolution: update to 1.1.9...

Event Registration Pro,3.2.12 - 3.2.10,SQL Injection

Event Registration Pro,3.2.12 - 3.2.10,SQL Injection resolution: update to 3.2.13 update notice: https://www.joomlashowroom.com/blog/event-registration-pro-3-2-13-released-security-release...

Universal AJAX Live Search, 5.4.0, Other

Universal AJAX Live Search 5.4.0, Other. Inadequate permissions Developer states: Extension Update Details Folders permissions vulnerability fixed. Resolution: update to versio 5.4.2 UpdateNoticeURL http://universalajaxlivesearch.demo.offlajn.com/index.php/simple-theme/security-update...

Eshop, versions before 1.4.4

Joomdonation extensions, Information Disclosure Eshop versions before 1.4.4 Resolution: update to 1.4.4 Update notice URL: http://joomdonation.com/forum/released-versions/50510-eshop-1-4-4-was-released-at-december-25-2015.html73480...

SimpleImageUpload by Tuts4You, 1.2 and below, Other

SimpleImageUpload by Tuts4You, 1.2, Other...

MT Fire Eagle

LFI http://joomlacode.org/gf/project/jfireeagle/frs/http://www.moto-treks.com 190410 product considered retired and to be replaced by dev Authors:...

[20110701] - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability...

chronoforms

A new update is now available: https://www.chronoengine.com/downloads/chronoforms/chronoforms-v8/chronoforms-v8-joomla-extension The affected range should be any version before v8.0.53 Best regards, Max & the ChronoEngine.com Team...

[20260102] - Core - XSS vectors in the pagebreak and pagenavigation plugins

Lack of output escaping leads to a XSS vector in the pagebreak and pagenavigation plugins...

EDocman, 1.23.3, XSS (Cross Site Scripting)

developer update https://joomdonation.com/forum/edocman/75400-01st-august-2023-new-version-1-24-7-xss-issue-fixed.html...

Next Gen Editor,2.1.0,SQL Injection

Next Gen Editor, 2.1.0, SQL Injection and multiple other vulnerabilities resolution: update to version 2.2.0 update notice: http://nextgeneditor.com/index.php/en/support/forum/installation-issues/3957-new-security-release...

Event Registration Pro,4.1.3,SQL Injection

Event Registration Pro, 4.1.3 and previous, SQL Injection Resolution: update to version 4.1.4 Update notice: https://www.joomlashowroom.com/blog/event-registration-pro-4-1-4-security-release...

JoomRecipe,1.0.3,SQL Injection

JoomRecipe ,1.0.3,SQL Injection UpdateNotice URL https://www.joomboost.com/blog-updates/entry/joomrecipe-version-1-0-4-security-announcement.html changelog Changelog Url https://www.joomboost.com/components-changelogs/60-joomrecipe-changelog.html...