751 matches found
JobGrok,versions 3.1, SQL Injection
JobGrok Listing - V3.1-1.2.58 and prior was vulnerable - comjobgroklist Resolution: update to V3.1-1.2.59 JobGrok Application - V3.1-1.2.55 and prior was vulnerable - comjobgrokapp Resolution: update to V3.1-1.2.56 JobGrok Premium - V3.1-1.6.69 and prior was vulnerable - comjobgrok Resolution:...
JEvents, pre 3.2.20
Extension: JEvents from jevents.net Vulnerability: SQL injection Versions affected prior to 3.2.20 Resolution: update to 3.2.20 - JEvents 3.4.0RC6 is also available for Joomla 3.4+ which fixes the same security issue. Update notice URL: https://www.jevents.net/component/zoo/item/jevents-33...
Contus HD Video Share (aka HDVideoShare) by Apptha [com_contushdvideoshare], 3.5 and below, Directory Traversal
Contus HD Video Share by Apptha comcontushdvideoshare, 3.5 and below, Directory Traversal...
EuropaCart, 8.0.1 and below ,
EuropaCart, 8.0.1, Other - ACL @Kryptronic...
bo:VideoJS, 2.1.1,
bo:VideoJS, 2.1.1, xss From developerhttp://www.boeschung.de/en/joomla/bo-videojs/video-js-v320...
[20120101] - Core - Information Disclosure
Inadequate filtering leads to information disclosure...
[20091103] - Core - Front-End Editor Issue
When logged into the front end with Author access, it was possible to replace an article written by another user...
Phoca Gallery, 5.0.0, XSS (Cross Site Scripting)
Update to 4.4.3, 4.5.0,5.0.1...
[20230501] - Core - Open Redirects and XSS within the mfa selection
Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen...
[20190302] - Core - XSS in item_title layout
The itemtitle layout in edit views lacks escaping, leading to a XSS vulnerability...
[20180501] - Core - ACL violation in access levels
Inadequate checks allowed users to modify the access levels of user groups with higher permissions...
User Bench 1.0, sql injection
User Bench by gegabyte.org, version 1.0, sql injection resolution: update to version 1.1 update notice: http://www.gegabyte.org/downloads/joomla-extensions/joomla3/components/307-user-bench...
Street Guesser,1.1.8,SQL Injection
Street Guesser by Normograph, version 1.1.8, SQL Injection resolution: update to 1.1.13 update notice: https://www.nordmograph.com/extensions/index.php?option=comvirtuemart=productdetailsproductid=160categoryid=1=58...
[20180507] - Core - Session deletion race condition
A long running background process, such as remote checks for core or extension updates, could create a race condition where a session which was expected to be destroyed would be recreated...
Directorix Directory Manager,1.1.1,SQL Injection
Directorix Directory Manager,1.1.1,SQL Injection...
[20170402] - Core - XSS Vulnerability
Inadequate filtering leads to XSS in the template manager component...
AceShop, up to version 4.1.3,
AceShop, up to version 4.1.3, SQL Injection...
Unite Horizontal Carousel
Unite Horizontal Carousel, , Directory Traversal Updated the extension, fixed the bug, the new version is 1.1 UpdateNoticeURL http://unitecms.net/news...
[20090603] - Core - Frontend XSS
Some values were output from the database without being properly escaped. Most strings in question were sourced from the administrator panel...
[20090101] - Core - JSession SSL Session Disclosure
When running a site under SSL ONLY the entire site is forced to be under ssl, Joomla! does not set the SSL flag on the cookie. This can allow someone monitoring the network to find the cookie related to the session. Please note that all data is still transferred securely...
[20200701] - Core - CSRF in com_installer ajax_install endpoint
A missing token check in the ajaxinstall endpoint cominstaller causes a CSRF vulnerability...
js jobs,1.1.5, 1.1.6, 1.2.5 and 1.2.6,Other
js jobs,1.1.5, 1.1.6, 1.2.5 and 1.2.6,Other Extension Update Details Fix the file security bug. new version number 2.1.7...
CW Article Attachments (Pro Version), SQL Injection
CW Article Attachments Pro Version from cwjoomla.com, versions 2.1.0 and previous, SQL Injection resolution: update to 2.1.2 update notice: http://www.cwjoomla.com/download-cw-article-attachments...
All Regular Labs extensions with editor buttons
All Regular Labs extensions with editor buttons, versions before 7 September 2018, cross site scripting XSS:- - Articles Anywhere - Conditional Content - Dummy Content - Modals - Modules Anywhere - Sliders - Snippets - Tabs - Tooltips The editor button popup urls could potentially be used...
ccNewsletter 2.2.3 security release
there is a SQL injection issue in ccNewsletter. I advice everyone using a ccNewsletter version before 2.2.2 to upgrade! You can download ccNewsletter 2.2.3 from our downloads section here. https://www.chillcreations.com/downloads/ccnewsletterreltabs-145-notes...
NS Download Shop, 2.2.6, SQL Injection
NS Download Shop, 2.2.6, SQL Injection Resolution: update to 2.2.8 Update notice: https://nswd.co/extensions/help-desk/security-release-v2-2-8...
Joomloc-lite by joomloc.fr,1.3.3,SQL Injection
Joomloc-lite by joomloc.fr, 1.3.3, SQL Injection Resolution: update to 1.4.1 Update Notice URL http://www.joomloc.fr.nf/telecharger/file/joomloc-lite-free-3.html...
Eventix Events Calendar by Informafix,1.0,SQL Injection
Eventix Events Calendar by Informafix, 1.0, SQL Injection...
kunena,4.0.10,Information Disclosure
kunena,4.0.10,Information Disclosure Developers update link https://www.kunena.org/blog/166-kunena-4-0-11-released...
Kunena, 5.0.2 and newer, XSS (Cross Site Scripting)
Kunena,5.0.2 and newer,XSS Cross Site Scripting resolutiion: update to 5.0.5 update notice: https://www.kunena.org/forum/announcement/id-107...
JS Jobs,1.1.5 and all previous,SQL Injection
JS Jobs,1.1.5 and all previous,SQL Injection Resolution: update to version 1.1.6 Update notice: https://www.joomsky.com/products/js-jobs.htmlfive...
BK Multithumb for Joomla 1.5, 2.5.0.4, XSS (Cross Site Scripting)
BK-Multithumb for Joomla 1.5, 2.5.0.4, XSS Cross Site Scripting Extension contains known vulnerable version of JS library prettyPhoto The vulnerability in JS file was patched by extension author on basis of 3.1.2 file. Update notice: http://joomla.rjews.net/bk-multithumb...
[20240804] - Core - Improper ACL for backend profile view
Improper Access Controls allows backend users to overwrite their username when disallowed...
[20240202] - Core - Open redirect in installation application
Inadequate parsing of URLs could result into an open redirect...
Solidres, 2.13.3, hub plugin XSS (Cross Site Scripting)
https://www.solidres.com/forum/report-bugs/12031-vulnerability-joomla-solidres-2-13-3-reflected-xss...
LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login , 5.0.2, Other
Other : 5.0.2 Exploit Check developer for new releases...
[20221002] - Core - RXSS through reflection of user input in headings
Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components...
[20190204] - Core - Stored XSS issue in the Global Configuration help url #2
Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS...
Quiz Deluxe,3.7.4,SQL Injection
Quiz Deluxe by joomplace, 3.7.4, SQL Injection resolution: update to 3.7.5 update notice: https://www.joomplace.com/blog/secure-your-quiz.html...
LMS King Pro, SQL Injection
LMS King Lite and LMS King Professional by king-products.net, versions up to 3.2.3.19 lite and 3.2.3.47 pro, SQL Injection resolution: update to version 3.2.3.20 lite and 3.2.3.48 pro update notice url: https://www.king-products.net/lms-king.html...
[20170704] - Core - Installer: Lack of Ownership Verification
The CMS installer application lacked a process to verify the users ownership of a webspace, potentially allowing users to gain control...
[20170401] - Core - Information Disclosure
Mail sent using the JMail API leaked the used PHPMailer version in the mail headers...
[20160801] - Core - ACL Violation
Inadequate ACL checks in comcontent provide potential read access to data which should be access restricted to users with editown level...
Spider Contacts 1.3.6 SQLI
Joomla Spider Contacts 1.3.6 SQL Injection Developer update http://web-dorado.com/products/joomla-contacts.html...
Joomlaworks allvideos
Joomlaworks allvideos plugin version 4.5.0 and previous XSS cross-site scripting Extension Update Details The new 4.6.0 version released replaces the XSS affected JW Player v5 with the newest v6. UpdateNoticeURL http://www.joomlaworks.net/forum/extension-updates/14896-june-3rd,-2014-allvideos-v4-...
[20120102] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability...
JS Jobs, 1.4.2, SQL Injection
JS Jobs Joomla - https://extensions.joomla.org/extension/js-jobs/ SQL injection SQLi Which versions are affected? 1.1.5 - 1.4.2...
[20250201] - Core - SQL injection vulnerability in Scheduled Tasks component
Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of comscheduler...