761 matches found
JUX Timetable x
JUX TimetableVersion: Old 1.0.4 / New 1.0.5 Update URL: https://extensions.joomla.org/extension/jux-timetable/ Download URL: https://demo.joomlaux.com/download/pkgjuxtimetable.zip...
All Regular Labs extensions with editor buttons
All Regular Labs extensions with editor buttons, versions before 7 September 2018, cross site scripting XSS:- - Articles Anywhere - Conditional Content - Dummy Content - Modals - Modules Anywhere - Sliders - Snippets - Tabs - Tooltips The editor button popup urls could potentially be used...
ccNewsletter 2.2.3 security release
there is a SQL injection issue in ccNewsletter. I advice everyone using a ccNewsletter version before 2.2.2 to upgrade! You can download ccNewsletter 2.2.3 from our downloads section here. https://www.chillcreations.com/downloads/ccnewsletterreltabs-145-notes...
JobGrok,versions 3.1, SQL Injection
JobGrok Listing - V3.1-1.2.58 and prior was vulnerable - comjobgroklist Resolution: update to V3.1-1.2.59 JobGrok Application - V3.1-1.2.55 and prior was vulnerable - comjobgrokapp Resolution: update to V3.1-1.2.56 JobGrok Premium - V3.1-1.6.69 and prior was vulnerable - comjobgrok Resolution:...
Joomloc-lite by joomloc.fr,1.3.3,SQL Injection
Joomloc-lite by joomloc.fr, 1.3.3, SQL Injection Resolution: update to 1.4.1 Update Notice URL http://www.joomloc.fr.nf/telecharger/file/joomloc-lite-free-3.html...
Kunena, 5.0.2 and newer, XSS (Cross Site Scripting)
Kunena,5.0.2 and newer,XSS Cross Site Scripting resolutiion: update to 5.0.5 update notice: https://www.kunena.org/forum/announcement/id-107...
[20170701] - Core - Information Disclosure
Improper cache invalidation leads to disclosure of form contents...
AceShop, up to version 4.1.3,
AceShop, up to version 4.1.3, SQL Injection...
Unite Horizontal Carousel
Unite Horizontal Carousel, , Directory Traversal Updated the extension, fixed the bug, the new version is 1.1 UpdateNoticeURL http://unitecms.net/news...
bo:VideoJS, 2.1.1,
bo:VideoJS, 2.1.1, xss From developerhttp://www.boeschung.de/en/joomla/bo-videojs/video-js-v320...
[20120303] - Core - Privilege Escalation
Programming error allows privilege escalation in some cases...
[20090605] - Core - Frontend XSS - PHP_SELF not properly filtered
An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser...
[20090101] - Core - JSession SSL Session Disclosure
When running a site under SSL ONLY the entire site is forced to be under ssl, Joomla! does not set the SSL flag on the cookie. This can allow someone monitoring the network to find the cookie related to the session. Please note that all data is still transferred securely...
Phoca Guestbook, , Other
https://www.phoca.cz/...
[20260712] - Core - Incorrect Access Control in com_fields webservice endpoints
An improper access check allows unauthorized users to create custom fields via webservices endpoints...
[20260520] - Framework - Inadequate content filtering within the cleanAttributes filter code
Lack of input filtering leads to an XSS vector in the HTML filter code...
Novarain/Tassos Framework, , SQL Injection
allow SQL injection and unauthenticated file reads. Attackers can chain these issues for administrator takeover and remote code execution on unpatched systems. Affected extensions include Convert Forms, EngageBox, Google Structured Data, Advanced Custom Fields, and Smile Pack, all relying on the...
[20250902] - Core - User-Enumeration in passkey authentication method
Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method...
paGO Commerce, 2.5.9.0, SQL Injection
paGO Commerce, 2.5.9.0, SQL Injection...
acymailing, 6.9.2,Other
acymailing, 6.9.2,Other Update to version 6.9.2 Developer did not inform the VEL team...
js jobs,1.1.5, 1.1.6, 1.2.5 and 1.2.6,Other
js jobs,1.1.5, 1.1.6, 1.2.5 and 1.2.6,Other Extension Update Details Fix the file security bug. new version number 2.1.7...
Easy Shop ,1.2.3 ,Other
Easy Shop ,1.2.3 ,Other Developer update 1.2.4 https://www.joomtech.net/blog/easyshop-1-2-4-security-issues-fixed Developer did not tellvel...
User Bench 1.0, sql injection
User Bench by gegabyte.org, version 1.0, sql injection resolution: update to version 1.1 update notice: http://www.gegabyte.org/downloads/joomla-extensions/joomla3/components/307-user-bench...
NS Download Shop, 2.2.6, SQL Injection
NS Download Shop, 2.2.6, SQL Injection Resolution: update to 2.2.8 Update notice: https://nswd.co/extensions/help-desk/security-release-v2-2-8...
kunena,4.0.10,Information Disclosure
kunena,4.0.10,Information Disclosure Developers update link https://www.kunena.org/blog/166-kunena-4-0-11-released...
[20160803] - Core - CSRF
Add additional CSRF hardening in comjoomlaupdate...
JEvents, pre 3.2.20
Extension: JEvents from jevents.net Vulnerability: SQL injection Versions affected prior to 3.2.20 Resolution: update to 3.2.20 - JEvents 3.4.0RC6 is also available for Joomla 3.4+ which fixes the same security issue. Update notice URL: https://www.jevents.net/component/zoo/item/jevents-33...
BK Multithumb for Joomla 1.5, 2.5.0.4, XSS (Cross Site Scripting)
BK-Multithumb for Joomla 1.5, 2.5.0.4, XSS Cross Site Scripting Extension contains known vulnerable version of JS library prettyPhoto The vulnerability in JS file was patched by extension author on basis of 3.1.2 file. Update notice: http://joomla.rjews.net/bk-multithumb...
Zen Library [zen], 1.0.2 and below, XSS (Cross Site Scripting)
Zen Library zen, 1.0.2, XSS Cross Site Scripting...
JB Library [jblibrary], 2.1.5 and below, XSS (Cross Site Scripting)
JB Library, 2.1.5 and below, XSS Cross Site Scripting...
OS Property - Joomla Real Estate sqli pre 2.8.1
OS Property - Joomla Real Estate sqli 12th May 2014 - New version 2.8.1 ============== Bug Fixed =============== 1. SQL Injection solved developer did not inform VEL...
Creative Contact Form [com_creativecontactform],2.0.0 and previous
Creative Contact Form comcreativecontactform,2.0.0 and previous,Other Resolution: Update to latest release 3.0.x Notice of Resolution: http://creative-solutions.net/joomla/creative-contact-form...
[20090604] - Core - Frontend XSS - HTTP_REFERER not properly filtered
An attacker can inject JavaScript or DHTML code that will be executed in the context of targeted user browser, allowing the attacker to steal cookies. HTTPREFERER variable is not properly parsed...
[20260711] - Core - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access comprivacy datasets...
[20260501] - Core - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules...
[20260102] - Core - XSS vectors in the pagebreak and pagenavigation plugins
Lack of output escaping leads to a XSS vector in the pagebreak and pagenavigation plugins...
Convert Forms, 4.4.10, XSS (Cross Site Scripting)
New 5.0 Update details: All XSS and SQL reported issues have been fixed in the latest release 5.0 Update URL: https://www.tassos.gr/releases/convert-forms/convert-forms-5-0-0 Changelog URL: https://www.tassos.gr/releases/convert-forms/convert-forms-5-0-0...
[20240705] - Core - XSS in com_fields default field value
The Custom Fields component not correctly filter inputs, leading to a XSS vector...
[20240801] - Core - Inadequate validation of internal URLs
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...
[20240701] - Core - XSS in accessible media selection field
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field...
Ordasoft CCK, 6.1.12 Various
Ordasoft CCK, 6.1.12 Various,,Other new version number...
JCE Editor,2.6.25, XSS (Cross Site Scripting)
JCE Editor Pro, Version 2.6.25 only, XSS Cross Site Scripting Resolution: update to 2.6.26 Update notice: https://www.joomlacontenteditor.net/news/jce-pro-2-6-26-released...
Street Guesser,1.1.8,SQL Injection
Street Guesser by Normograph, version 1.1.8, SQL Injection resolution: update to 1.1.13 update notice: https://www.nordmograph.com/extensions/index.php?option=comvirtuemart=productdetailsproductid=160categoryid=1=58...
Huge IT Portfolio Gallery 1.0.7 and previous
Huge IT Portfolio Gallery 1.0.7 and previous Security updates connected with CSRF and XSS resolution: update to 1.1.0...
[20170408] - Core - Information Disclosure
Multiple files caused full path disclosures on systems with enabled error reporting...
JNews,8.5.1,SQL Injection
JNews, 8.5.1 and all previous, SQL Injection Resolution: update to 8.7.1 Update notice url: http://www.joobi.co/blog/jnews-8-7-released.html Note that due to discrepancy in developer's code between package and repository, some versions of previous security release 8.6.1 are still vulnerable...
Master User, versions before 2.1.4
Versions before 2.1.4 suffered from an issue with insecure default settings, the issue affects Joomla 3.4 sites only, but users are advised by the developer to update anyway. Resolution: Update to version 2.1.4 Update notice URL:...
Kunena 4.0.2 xss resolution
This version is a security release and addresses most of the important issues that were discovered in K 4.0.1 Developer update statement http://www.kunena.org/blog/149-kunena-4-0-2-released developer @kunena did not inform VEL...