[20210307] - Core - ACL violation within com_content frontend editing

Incorrect ACL checks could allow unauthorized change of the category for an article...

[20190201] - Core - Lack of URL filtering in various core components

Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability...

[20180103] - Core - XSS vulnerability in Uri class

Inadequate input filtering in the Uri class formerly JUri leads to a XSS vulnerability...

[20170901] - Core - Information Disclosure

A logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state...

Cookie consent from silktide, Unknown version, Other

Cookie consent from silktide, Unknown version, Malicious links aka https://cookieconsent.insites.com/download/ When the Cookie Consent plugin by Silktide stopped using Amazon CDN, someone hijacked their Amazon storage and began serving malicious scripts so that sites that still use old version of...

[20170703] - Core - XSS Vulnerability

Inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components...

Vik Appointments 1.4 and previous

Vik Appointments 1.4 and previous, SQL Injection Resolution: update to 1.5 Update notice: https://extensionsforjoomla.com/blog/12-updates/46-security-notices-sql-injection-reports...

[20150601] - Core - Open Redirect

Inadequate checking of the return value allowed to redirect to an external page...

[20090601] - Core - com_users XSS

A XSS vulnerability exists in the user view of comusers in the administrator panel...

[20090302] - Core - com_content XSS

A XSS vulnerability exists in the category view of comcontent...

[20260305] - Core - Arbitrary file deletion in com_joomlaupdate

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism...

[20240802] - Core - Cache Poisoning in Pagination

The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors...

[20240203] - Core - XSS in media selection fields

Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions...

adblock detector nordmograph

Malicious script New in 2.1 : Miner feature discontinued This is a security release for the 3.x series of Joomla! This release fixes one low level security issues...

JCE Pro, 2.8.15, xss

This 2.8.15 an important security update is included to prevent potential cross-site scripting attacks. https://www.joomlacontenteditor.net/news/jce-pro-2-8-15-released...

[20200705] - Core - Escape mod_random_image link

Lack of input filtering and escaping allows XSS attacks in modrandomimage...

JS support ticket,1.1.5,Directory Traversal

JS support ticket,1.1.5,Directory Traversal resolution: update to 1.1.6 update notice: https://joomsky.com/products/js-ticket-joomla.html...

[20180602] - Core - XSS vulnerability in language switcher module

In some cases the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page url...

[20181004] - Core - ACL Violation in com_users for the admin verification

In case that an attacker gets access to the mail account of an user who can approve admin verifications in the registration process he can activate himself...

Survey Force Deluxe,3.2.4,SQL Injection

Survey Force Deluxe by Joomplace, 3.2.4, SQL Injection resolution: update to 3.2.5 update notice: https://www.joomplace.com/blog/survey-3-2-5-patch.html...

Joomla Payage, 2.05, SQL Injection

Joomla Payage, 2.05 and previous, SQL Injection Resolution: update to 2.0.6 Update notice: http://www.lesarbresdesign.info/version-history/payage...

JoomDoc 4.0.3 and previous

JoomDoc 4.0.3 and previous information disclosure resolution: update to 4.0.4 update notice: http://www.artio.net/newsflash/joomdoc-404-release...

Yeeditor, abandonware

Yeeditor from Yeedeen development apparently abandoned, developer's site is infected with malware All versions prior to 1.0.7 contain file upload vulnerability...

Breezing Forms Full

Breezing Forms Full before build 884 Information disclosure Resolution: update to latest version Update notice: https://crosstec.org/en/blog/859-breezingforms-medium-security-update.html...

swmenufree, v8.3 ,Other

swmenufree, swMenuFree 8.3 for Joomla 2.5.x and 3.x , other Resolution: update to version 8.5 Update notice: http://www.swmenupro.com/downloads/swmenufree.html?view=document=1...

Solidres previous to 8.0.0

Solidres previous to 8.0.0 SQL Injection Update to 8.0.0 Update notice URL http://www.solidres.com/blog/2015/01/26/solidres-0-8-0-released/...

[20120305] - Core - Password Change

Insufficient randomness leads to password reset vulnerability...

[20210301] - Core - Insecure randomness within 2FA secret generation

Usage of the insecure rand function within the process of generating the 2FA secret.Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...

[20210402] - Core - Inadequate filters on module layout settings

Inadequate filters on module layout settings could lead to an LFI...

Easy Discuss 4.1.9 SQL Injection

Easy Discuss 4.1.9 by Stack Ideas, SQL Injection Resolution: update to 4.1.10 update notice: https://stackideas.com/blog/important-security-update-for-easydiscuss4-1-10...

[20190304] - Core - Missing ACL check in sample data plugins

The sample data plugins lack ACL checks, allowing unauthorized access...

[20190205] - Core - XSS Issue in core.js writeDynaList

Inadequate parameter handling in JS code could lead to an XSS attack vector...

[20181005] - Core - CSRF hardening in com_installer

Added additional CSRF hardening in cominstaller actions in the backend...

[20180503] - Core - Information Disclosure about unpublished tags

Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission...

Easy Discuss, 4.0.20, XSS

Easy Discuss by Stackideas, versions 4.0.20 and previous, XSS Resolution: update to 4.0.21 update notice: https://stackideas.com/blog/easydiscuss4021-update...

Vik Rent Items 1.3 and previous

Vik Rent Items 1.3 and previous SQL injection Resolution:update to version 1.4 Update notice: https://extensionsforjoomla.com/blog/12-updates/46-security-notices-sql-injection-reports...

J-BusinessDirectory 4.5.4 and previous

J-BusinessDirectory 4.5.4 and previous sql injection resolution: update to 4.5.5 update notice: http://www.cmsjunkie.com/blog/joomlabusinessdirectory4-5-5release/...

[20170406] - Core - ACL Violations

Inadequate filtering of form contents lead allow to overwrite the author of an article...

[20161203] - Core - Information Disclosure

Inadequate ACL checks in the Beez3 comcontent article layout override enables a user to view restricted content...

Zen Library [zen], 1.0.2 and below, XSS (Cross Site Scripting)

Zen Library zen, 1.0.2, XSS Cross Site Scripting...

[20080801] - Core - Password Remind Functionality

A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user lowest id. Typically, this is an administrator user. Note, that changing the first users username may...

[20240803] - Core - XSS in HTML Mail Templates

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

[20240702] - Core - Self-XSS in fancyselect list field layout

The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector...

HikaShop Joomla Plugin, , SQL Injection

anyone with access to the order management in the backend of HikaShop to be able to use a MySQL injection to extract data from the database. "payment methods" restriction setting to custom fields of the "order" table in HikaShop 4.4.1, so prior versions of HikaShop are not impacted...

J-BusinessDirectory, 5.7.7 and prior, Other

In the J-BusinessDirectory version 5.8.3 we have updated guzzlehttp to the latest version, 7.5.0 and to PSR 2.1.5...

Balbooa Forms, 2.0.6 (not tested on others), SQL Injection

Balbooa Forms, 2.0.6 , SQL Injection...

[20220303] - Core - User row are not bound to a authentication mechanism

A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover...

[20210303] - Core - XSS within alert messages showed to users

Missing filtering of messages showed to users that could lead to xss issues...

jDownloads,3.2.64,SQL Injection

jDownloads,3.2.64,SQL Injection Developers update http://www.jdownloads.com/index.php/downloads/download/6-jdownloads/2-jdownloads-3-2.htmljd65...

[20190203] - Core - Additional warning in the Global Configuration textfilter settings

"No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior but might be unexpected for the user. An additional message is now shown in the configuration dialog...