761 matches found
[20260301] - Core - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers...
rsdirectory
Extension: RSDirectory! Version: Old 2.2.7 / New 2.2.8 Update details: Versions affected 1.0.0 through 2.2.7 Stored XSS allows remote authenticated attackers to inject arbitrary web script or HTML via the review reply component. Fixed in 2.2.8 Update URL:...
GPS Tools v4.0.1,4.0.1,SQL Injection
GPS Tools v4.0.1,4.0.1,SQL Injection Developer release statement to the vel team https://www.corejoomla.com/news/1163-gps-tools-v4-0-2-is-released.html...
[20260810] - Core - Unrestricted uploads of SHTML files
The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...
[20260804] - Core - Improper ACL checks for custom fields webservice endpoints
An improper access check allows unauthorized users to create fields for inaccessible components...
[20260801] - Core - Response header injection in download views
Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...
[20260809] - Core - Improper ACL checks when injection schema.org contact data
An improper access check injects contact information for unaccessible contact items into schema.org snippets...
[20260807] - Core - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
[20260808] - Core - Improper ACL checks for batch copy actions
An improper access check allows unauthorized users to perform copy batch operations on uneditable items...
[20260805] - Core - Improper ACL checks for category webservice endpoints
An improper access check allows unauthorized users to create categories for inaccessible components...