761 matches found
[20090604] - Core - Frontend XSS - HTTP_REFERER not properly filtered
An attacker can inject JavaScript or DHTML code that will be executed in the context of targeted user browser, allowing the attacker to steal cookies. HTTPREFERER variable is not properly parsed...
[20090605] - Core - Frontend XSS - PHP_SELF not properly filtered
An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser...
[20260519] - Framework - Inadequate content filtering within the checkAttribute filter code
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components...
Convert Forms, 4.4.10, XSS (Cross Site Scripting)
New 5.0 Update details: All XSS and SQL reported issues have been fixed in the latest release 5.0 Update URL: https://www.tassos.gr/releases/convert-forms/convert-forms-5-0-0 Changelog URL: https://www.tassos.gr/releases/convert-forms/convert-forms-5-0-0...
[20250102] - Core - XSS vector in the id attribute of menu lists
Lack of output escaping in the id attribute of menu lists...
acymailing, pre 8.7.0 , Other
acymailing, pre 8.7.0 , Other multiple...
jCart for OpenCart, jCart for OpenCart 3.0.3.19, XSS (Cross Site Scripting)
Here is the link on our site: https://extensions.soft-php.com/support/latest-news/79-joocart-jcart-30325-release-notice.html...
CMS2CMS, Connector Extension, 2.00 permissions
CMS2CMS Connector Extension 2.00 Update of the permission type created for the catalog file 2.01...
Ordasoft CCK, 6.1.12 Various
Ordasoft CCK, 6.1.12 Various,,Other new version number...
fabrik 3.9,Various
,fabrik 3.9. Various Issues NOTE: the earlier version number was a mistake by the reporter. new version number 3.9.1 Update Notice URL https://fabrikar.com/blog/87-fabrik-3-9-1-released...
[20190303] - Core - XSS in media form field
The media form field lacks escaping, leading to a XSS vulnerability...
JCE Editor,2.6.25, XSS (Cross Site Scripting)
JCE Editor Pro, Version 2.6.25 only, XSS Cross Site Scripting Resolution: update to 2.6.26 Update notice: https://www.joomlacontenteditor.net/news/jce-pro-2-6-26-released...
Ajax Quiz by Webkul,2.0,SQL Injection
Ajax Quiz by Webkul, 2.0 and previous, SQL Injection Resolution: update to version 2.1 Update notice: https://store.webkul.com/AjaxQuiz.html...
Quiz Deluxe,3.7.4,SQL Injection
Quiz Deluxe by joomplace, 3.7.4, SQL Injection resolution: update to 3.7.5 update notice: https://www.joomplace.com/blog/secure-your-quiz.html...
Bye Bye Password,1.0.4,Information Disclosure
Bye Bye Password by Ready Bytes, versions 1.0.4 and previous, Information Disclosure Also the installer includes a tracking script...
[20170705] - Core - XSS Vulnerability
Inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components...
[20170403] - Core - XSS Vulnerability
Inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components...
Google Map Store Locator by Matamko,4.0,SQL Injection
Google Map Store Locator by Matamko, 4.0, SQL Injection...
Canonical Url,4.1.1,SQL Injection
Canonical Url by CMSPlugin.com, 4.1.1, SQL Injection Resolution: update to 4.2.1 Update notice: https://www.cmsplugin.com/products/components/4-canonical-url...
K2,2.7.0,XSS (Cross Site Scripting)
K2,2.7.0,XSS Cross Site Scripting resolution: update to 2.7.1 update notice url: https://getk2.org/blog/2571-k2-v271-released Note that the VEL do not agree with the developer's assessment that XSS vulnerability is low priority...
mod fancy tag cloud,1.017,Other
mod fancy tag cloud comofflajninstaller,1.017,Other resolution: update to version 1.020 update notice: http://fancytagcloud.demo.offlajn.com/index.php/security-update existing users may also need to fix folder permissions, please contact the developer for further information...
"J-ClassifiedsManager" by CMSjunkie
"J-ClassifiedsManager" by CMSjunkie, versions before 2.1.0, SQL injection Resolution Update to 2.1.0 UpdateNoticeURL http://www.cmsjunkie.com/blog/joomla-classifieds-manager-2-1-0-release/...
sbahjaoui contact 1.0
sbahjaoui contact version 1.0 SQL Injection Resolution: update to version 1.1 Update notice: http://www.sbahjaoui-info.com/en/extensions/category/10-sbahjaoui-contact.html ttweetfsubscribe...
Akeeba CMS Update
Extension Update Details Akeeba CMS Update 1.0.2 Update Notice URL https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html...
JDownloads
unauthorized file upload vulnerable versions: below 1.9.1.6 Joomla 2.5 and below 1.9.2.11 Joomla 3 security release announcement: http://www.jdownloads.com/index.php?option=comcontent=article=231:urgent-security-update-for-19-series=51:news Note that the developer did not inform the VEL...
Joomla Multicalendar, 5.3.2 and previous versions,
Joomla Multicalendar, 5.3.2 and previous versions, XSS Cross Site Scripting UpdateNoticeURL http://www.joomlacalendars.com/faq/multi-view-calendar-for-joomlaq39...
kunena 3.0.5 XSS and SQL Injection
kunena 3.0.5 XSS and SQL Injection Update notice http://www.kunena.org/blog/139-kunena-3-0-6-released...
CiviCRM 4.3.3 and previous
CiviCRM, = 4.3.3, XSS Cross Site Scripting Update Notice URL http://civicrm.org/blogs/colemanw/security-release-civicrm-434...
[20120602] - Core - Information Disclosure
Inadequate filtering leads SQL error and information disclosure...
[20120901] - Core - XSS Vulnerability
Inadequate escaping of output leads to XSS vulnerability...
[20120304] - Core - Password Change
Insufficient randomness leads to password reset vulnerability...
[20120203] - Core - Information Disclosure
Inadequate validation leads to path disclosure in administrator...
[20111101] - Core - XSS Vulnerability
Inadequate filtering leads to XSS vulnerability in back end...
[20260101] - Core - Inadequate content filtering for data URLs
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags...
[20240801] - Core - Inadequate validation of internal URLs
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...
quickform, , Other
Developer states exploit is "hack yourself" scenario...
JC Dashboards, 1.3.10, Other
JCDashboards updated latest version V1.3.31 as this includes a fix for a possible security leak should your linux server not be configured correctly in certain circumstances. changelog | Download url ---|--- https://joomcode.com/jcmedia/comjcdashboards/versionhistory.html |...
oziogallery,5.0.1,XSS (Cross Site Scripting)
oziogallery,5.0.1,XSS Cross Site Scripting Update Notice URL https://www.facebook.com/groups/oziogallery/permalink/1588619457938122/ Change log Url https://www.opensourcesolutions.es/en/ext/ozio-gallery.htmlChangelog...
AcyMailing 5.10.6 Various
AcyMailing 5.10.6 Various new version number 5.10.7 UpdateNotice URL https://www.acyba.com/support/change-log.html Changelog Url https://www.acyba.com/support/change-log.html...
kunena,5.1.7,XSS (Cross Site Scripting)
kunena,5.1.7,XSS Cross Site Scripting https://www.kunena.org/blog/201-kunena-5-1-8-released...
kunena,5.1.6.1,XSS (Cross Site Scripting)
kunena,5.1.6.1,XSS Cross Site Scripting Developer statement: Update to 5.1.7 https://www.kunena.org/blog/200-kunena-5-1-7-released...
Calendar Planner 1.0.1 - SQL Injection
Calendar Planner 1.0.1 - SQL Injection resolution: update to 1.0.2 update notice: http://www.joomlathat.com/news/news/calendar-planner/calendar-planner-1-0-2-security-release...
Myportfolio,3.0.2,SQL Injection
Myportfolio,3.0.2,SQL Injection Developer statement new version number 3.0.3 Update Notice URL https://www.samybaxy.net/...
Joomloc-CAT, version 4.1.3, SQL injection
Joomloc-CAT, version 4.1.3, SQL injection Resolution: update to 4.2.1 Update Notice URL http://www.joomloc.fr.nf/en/downloads-products/file/joomloc-pro-channel-manager-pms.html...
JE Property Finder, 1.6.3
JE Property Finder,1.6.3,SQL Injection...
Community Builder versions 2.1 and previous
Community Builder Versions 2.1.0 and previous contain versions of 3rd party libraries with known vulnerabilities: PHPMailer and Guzzle Release 2.1.1 updates to version 5.2.22 of PHP Mailer provides custom fix for Guzzle library Developer states that this is precautionary only, and that these...
JMS Support Online module, 2.0.0, XSS (Cross Site Scripting)
JMS Support Online module,2.0.0,XSS Cross Site Scripting...
nitroslider,1.0.0
nitroslider,1.0.0 open folder permissions update to 1.0.1 update notice: https://www.themechoice.com/joomla-extensions/nitro-layer-slider...
Events Booking, versions before 2.1.1
Joomdonation extensions, Information Disclosure Events Booking versions before 2.1.1 Resolution: update to 2.1.1 Update notice URL: http://joomdonation.com/forum/events-booking-general-discussion/50511-events-booking-version-2-1-1-released.html...