HikaShop Joomla Plugin, , SQL Injection

anyone with access to the order management in the backend of HikaShop to be able to use a MySQL injection to extract data from the database. "payment methods" restriction setting to custom fields of the "order" table in HikaShop 4.4.1, so prior versions of HikaShop are not impacted...

[20210402] - Core - Inadequate filters on module layout settings

Inadequate filters on module layout settings could lead to an LFI...

JS support ticket,1.1.5,Directory Traversal

JS support ticket,1.1.5,Directory Traversal resolution: update to 1.1.6 update notice: https://joomsky.com/products/js-ticket-joomla.html...

Joomla Payage, 2.05, SQL Injection

Joomla Payage, 2.05 and previous, SQL Injection Resolution: update to 2.0.6 Update notice: http://www.lesarbresdesign.info/version-history/payage...

[20170704] - Core - Installer: Lack of Ownership Verification

The CMS installer application lacked a process to verify the users ownership of a webspace, potentially allowing users to gain control...

Resize Image On The Fly and Cache 1.1.0 and previous

Resize Image On The Fly and Cache - content plugin by s2software.it Version 1.1.0 and likely all previous Open folder permissions Resolution: update to version 1.3.3 Existing users will need to manually fix the permissions of folder /images/cache to 755 or delete it in order to be recreated by th...

Helpdesk Pro by Ossolution Team [com_helpdeskpro], before 1.4.0, multiple vulns

Helpdesk Pro by Ossolution Team comhelpdeskpro, before 1.4.0, multiple vulns Vulnerabilities: Direct Object References Cross-Site Scripting SQL Injection Local file disclosure/Path traversal File Upload Fixed: vulnerability fixed in version 1.4.0 Developer's notice:...

[20240804] - Core - Improper ACL for backend profile view

Improper Access Controls allows backend users to overwrite their username when disallowed...

[20221002] - Core - RXSS through reflection of user input in headings

Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components...

adblock detector nordmograph

Malicious script New in 2.1 : Miner feature discontinued This is a security release for the 3.x series of Joomla! This release fixes one low level security issues...

[20220304] - Core - Missing input validation within com_fields class inputs

Lack of input validation could allow an XSS attack using comfields...

Cookie consent from silktide, Unknown version, Other

Cookie consent from silktide, Unknown version, Malicious links aka https://cookieconsent.insites.com/download/ When the Cookie Consent plugin by Silktide stopped using Amazon CDN, someone hijacked their Amazon storage and began serving malicious scripts so that sites that still use old version of...

[20180507] - Core - Session deletion race condition

A long running background process, such as remote checks for core or extension updates, could create a race condition where a session which was expected to be destroyed would be recreated...

[20170401] - Core - Information Disclosure

Mail sent using the JMail API leaked the used PHPMailer version in the mail headers...

JoomDoc 4.0.3 and previous

JoomDoc 4.0.3 and previous information disclosure resolution: update to 4.0.4 update notice: http://www.artio.net/newsflash/joomdoc-404-release...

Yeeditor, abandonware

Yeeditor from Yeedeen development apparently abandoned, developer's site is infected with malware All versions prior to 1.0.7 contain file upload vulnerability...

[20161203] - Core - Information Disclosure

Inadequate ACL checks in the Beez3 comcontent article layout override enables a user to view restricted content...

[20170405] - Core - XSS Vulnerability

Inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component...

[20080801] - Core - Password Remind Functionality

A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user lowest id. Typically, this is an administrator user. Note, that changing the first users username may...

Easy Discuss, 4.0.20, XSS

Easy Discuss by Stackideas, versions 4.0.20 and previous, XSS Resolution: update to 4.0.21 update notice: https://stackideas.com/blog/easydiscuss4021-update...

[20170403] - Core - XSS Vulnerability

Inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components...

swmenufree, v8.3 ,Other

swmenufree, swMenuFree 8.3 for Joomla 2.5.x and 3.x , other Resolution: update to version 8.5 Update notice: http://www.swmenupro.com/downloads/swmenufree.html?view=document=1...

Solidres previous to 8.0.0

Solidres previous to 8.0.0 SQL Injection Update to 8.0.0 Update notice URL http://www.solidres.com/blog/2015/01/26/solidres-0-8-0-released/...

Joomlaworks allvideos

Joomlaworks allvideos plugin version 4.5.0 and previous XSS cross-site scripting Extension Update Details The new 4.6.0 version released replaces the XSS affected JW Player v5 with the newest v6. UpdateNoticeURL http://www.joomlaworks.net/forum/extension-updates/14896-june-3rd,-2014-allvideos-v4-...

[20120101] - Core - Information Disclosure

Inadequate filtering leads to information disclosure...

Phoca Maps pre version 6.1.0, other

Phoca Maps pre version 6.1.0, other...

[20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views...

J-BusinessDirectory, 5.7.7 and prior, Other

In the J-BusinessDirectory version 5.8.3 we have updated guzzlehttp to the latest version, 7.5.0 and to PSR 2.1.5...

jDownloads,3.2.64,SQL Injection

jDownloads,3.2.64,SQL Injection Developers update http://www.jdownloads.com/index.php/downloads/download/6-jdownloads/2-jdownloads-3-2.htmljd65...

Easy Discuss 4.1.9 SQL Injection

Easy Discuss 4.1.9 by Stack Ideas, SQL Injection Resolution: update to 4.1.10 update notice: https://stackideas.com/blog/important-security-update-for-easydiscuss4-1-10...

[20190303] - Core - XSS in media form field

The media form field lacks escaping, leading to a XSS vulnerability...

J-CruiseReservation 6.0.2 sqli

new version number 6.0.4 UpdateNotice URL https://www.cmsjunkie.com/blog/cruise-reservations-update/...

Survey Force Deluxe,3.2.4,SQL Injection

Survey Force Deluxe by Joomplace, 3.2.4, SQL Injection resolution: update to 3.2.5 update notice: https://www.joomplace.com/blog/survey-3-2-5-patch.html...

Vik Rent Items 1.3 and previous

Vik Rent Items 1.3 and previous SQL injection Resolution:update to version 1.4 Update notice: https://extensionsforjoomla.com/blog/12-updates/46-security-notices-sql-injection-reports...

[20170705] - Core - XSS Vulnerability

Inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components...

Directorix Directory Manager,1.1.1,SQL Injection

Directorix Directory Manager,1.1.1,SQL Injection...

[20120102] - Core - XSS Vulnerability

Inadequate filtering leads to XSS vulnerability...

[20111002] - Core - Information Disclosure

Inadequate error checking causes potential information disclosure...

[20110902] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in back end...

[20090605] - Core - Frontend XSS - PHP_SELF not properly filtered

An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser...

[20090603] - Core - Frontend XSS

Some values were output from the database without being properly escaped. Most strings in question were sourced from the administrator panel...

Phoca Gallery, 5.0.0, XSS (Cross Site Scripting)

Update to 4.4.3, 4.5.0,5.0.1...

Balbooa Forms, 2.0.6 (not tested on others), SQL Injection

Balbooa Forms, 2.0.6 , SQL Injection...

[20200701] - Core - CSRF in com_installer ajax_install endpoint

A missing token check in the ajaxinstall endpoint cominstaller causes a CSRF vulnerability...

Phoca Gallery,4.3.15 prior,Other

Phoca Gallery,4.3.15 prior,Other Update Notice URL https://www.phoca.cz/news/1029-phoca-gallery-4-3-17-released...

All Regular Labs extensions with editor buttons

All Regular Labs extensions with editor buttons, versions before 7 September 2018, cross site scripting XSS:- - Articles Anywhere - Conditional Content - Dummy Content - Modals - Modules Anywhere - Sliders - Snippets - Tabs - Tooltips The editor button popup urls could potentially be used...

[20171103] - Core - Information Disclosure

A logic bug in comfields exposed read-only information about a site's custom fields to unauthorized users...

Eventix Events Calendar by Informafix,1.0,SQL Injection

Eventix Events Calendar by Informafix, 1.0, SQL Injection...

JS Jobs,1.1.5 and all previous,SQL Injection

JS Jobs,1.1.5 and all previous,SQL Injection Resolution: update to version 1.1.6 Update notice: https://www.joomsky.com/products/js-jobs.htmlfive...

J-BusinessDirectory 4.5.4 and previous

J-BusinessDirectory 4.5.4 and previous sql injection resolution: update to 4.5.5 update notice: http://www.cmsjunkie.com/blog/joomlabusinessdirectory4-5-5release/...