CVE-2018-15881

CVE-2018-15881 : Joomla! prior to 3.8.12 contains an ACL violation caused by inadequate checks regarding disabled fields in the admin/custom-field flow. This affects the core application’s access-control handling and can allow unauthorized operations that bypass restrictions. The vulnerability is...

CVE-2018-6377

CVE-2018-6377 is a cross-site scripting (XSS) in Joomla! Core component com_fields caused by inadequate input filtering. The vulnerability affects Joomla! CMS versions 3.7.0 through 3.8.3 and can lead to arbitrary script execution in the target user’s browser when fields are manipulated. Remediat...

CVE-2018-6380

CVE-2018-6380 affects Joomla! 3.x prior to 3.8.4, due to lack of escaping in the module chromes, resulting in reflected XSS. Affected range includes 3.0.0–3.8.3 per the public entry and Nessus findings explicitly tie this CVE to Joomla! 3.0.x through 3.8.3 in multiple scans. The underlying issue ...

CVE-2018-11328

CVE-2018-11328 affects Joomla! Core up to version 3.8.7. The issue arises when a redirect Location header contains a username:password in the URI and the user-info portion is not escaped, enabling a Cross-Site Scripting (XSS) vector. Exploitation path is consistent with “Possible XSS attack in th...

CVE-2018-11322

CVE-2018-11322 relates to Joomla! Core up to version 3.8.7 where PHAR files can be treated by the webserver as executable PHP scripts depending on server configuration. Connected sources confirm Joomla! 3.x line variants (up to 3.8.7) are affected by multiple vulnerabilities, including issues aro...

CVE-2018-15882

CVE-2018-15882 concerns Joomla! before 3.8.12, where inadequate checks in the InputFilter class could allow specifically prepared phar files to bypass the upload filter. The vulnerability enables bypass of upload controls, potentially enabling attackers to introduce malicious content. The issue i...

CVE-2018-6378

CVE-2018-6378 affects Joomla! Core prior to 3.8.8, where inadequate filtering of file and folder names in the media manager enables XSS vectors. Connected sources reference Joomla media manager XSS and related issues in versions up to 3.8.7 (and earlier), with remediation aligning to upgrading to...

CVE-2018-15880

Joomla! before 3.8.12 is vulnerable to a stored XSS on the user profile page due to inadequate output filtering. Affected: Joomla! CMS versions prior to 3.8.12 (noting an additional ACL issue in 3.7.0–3.8.11). Impact, as stated, is stored XSS; no exploitation status is provided. Remediation: upgr...

CVE-2018-11326

Joomla! Core prior to 3.8.8 is affected by multiple XSS vulnerabilities caused by inadequate input filtering. The issue may be exacerbated by default filtering settings that could let users in the default Administrator group perform an XSS attack. Affected versions are Joomla! Core up to 3.8.7 (b...

CVE-2018-11321

CVE-2018-11321 affects Joomla! Core via the com_fields component. The issue arises from inadequate filtering in the field filtering logic, allowing authorized users who create custom fields to manipulate filtering options and inject an unvalidated option, potentially enabling remote code executio...

CVE-2018-6376

CVE-2018-6376 ( Joomla! ) describes a SQL injection vulnerability in the Hathor postinstall message due to the lack of type casting of a variable within a SQL statement in Joomla! versions prior to 3.8.4. Affected is Joomla! up to 3.8.3. Root cause: improper handling of input in SQL context leadi...

CVE-2012-1563

CVE-2012-1563 is described across multiple sources as a Joomla! vulnerability that allows an attacker to create an administrator account in affected installations. The core issue is consistently referenced as Joomla! before 2.5.3, with exploit tooling and public writeups targeting Joomla! 2.5.x (...

CVE-2018-11325

CVE-2018-11325 affects Joomla! Core prior to 3.8.8. The issue is that the web install application would autofill and display the administrator password in plaintext on the confirmation screen after a form validation error or returning to a previous install step. Connected documents corroborate th...

CVE-2018-11323

Technical details for CVE-2018-11323 are not provided in the connected documents. The sources list Joomla vulnerabilities by version without specifics for this CVE. Monitor for updates.

CVE-2018-11327

CVE-2018-11327 affects Joomla! Core up to version 3.8.8. Affected: information disclosure via unpublished or restricted-view tag names through inadequate checks in core handling of tags. Impact: disclosure of metadata about unpublished tags to users who should not see them. The connected scans in...

CVE-2018-6379

CVE-2018-6379 affects Joomla! up to version 3.8.3, due to inadequate input filtering in the Uri (JUri) class, enabling XSS. Affected range: 1.5.0–3.8.3; fixed in 3.8.4. Connected scans confirm the Uri class XSS (CVE-2018-6379) among Joomla! vulnerabilities; no exploitation details provided in the...

CVE-2006-4469

Joomla! prior to version 1.0.11 is affected by a remote code execution vulnerability in includes/PEAR/PEAR.php. The issue enables unauthenticated remote attackers to execute arbitrary code due to injection flaws in PEAR.php, with exploitation depending on PHP settings (register_globals) and PHP v...

CVE-2006-1957

The CVE-2006-1957 entry affects the com_rss option (rss.php) in Mambo and Joomla!. The vulnerability allows remote attackers to trigger a denial of service (disk consumption and potentially web-server outage) by issuing multiple requests with different values of the feed parameter. Public referen...

CVE-2007-5577

CVE-2007-5577 affects Joomla! (pre-1.0.13, aka Sunglow). The vulnerability allows remote XSS via the Section Manager’s Title/Section Name fields and multiple fields in New Menu Item, enabling injection of arbitrary script/HTML. Affected component/versions are stated; impact is client-side script ...

CVE-2009-1499

The CVE-2009-1499 entry describes an SQL injection in the Joomla! MailTo (com_mailto) component. The vulnerability allows remote attackers to execute arbitrary SQL commands via the article parameter in index.php, indicating a remote‑code capable injection affecting the application’s database quer...

CVE-2018-11324

CVE-2018-11324 affects Joomla! Core prior to 3.8.8. A long-running background process (e.g., remote checks for core/extension updates) could create a race condition where a session that should have been destroyed is recreated, leading to potential session handling inconsistencies. The publicly do...

CVE-2010-2679

The vulnerability CVE-2010-2679 affects the Joomla! WebLinks extension (com_weblinks). It is a SQL injection flaw that can be triggered by the id parameter in the view action of index.php, allowing remote attackers to execute arbitrary SQL commands. The issue is documented with a high-severity CV...

CVE-2007-4188

CVE-2007-4188 describes a session fixation vulnerability in Joomla! versions prior to 1.0.13 (Sunglow). The issue allows an attacker to hijack an administrator web session via unspecified vectors by manipulating session handling. Affected product: Joomla! CMS (pre-1.0.13). Reported impact is remo...

CVE-2007-4189

Joomla! before 1.0.13 (Sunglow) has XSS vulnerabilities affecting the com_search, com_content, and mod_login components. The provided documents describe multiple XSS flaws with unspecified vectors, indicating remote script/HTML injection possibilities. No explicit root-cause details, affected ver...

CVE-2011-3629

Joomla! core 1.7.1 is affected by CVE-2011-3629, which enables information disclosure due to weak encryption. The linked records (NVD/RH, Nessus 113944, CNVD, etc.) consistently describe a vulnerability in Joomla! affecting 1.7.1 that exposes sensitive information through weak cryptographic pract...

CVE-2007-4190

CVE-2007-4190 (Joomla!) : A CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and potentially perform HTTP response splitting, which can enable cross-site scripting in some cases. The flaw arises from CRLF sequences in the...

CVE-2006-4468

CVE-2006-4468 affects Joomla! prior to 1.0.11. The vulnerability set involves multiple input- handling weaknesses (unvalidated input) across several components: mosMail, JosIsValidEmail, josSpoofValue, missing inclusion of globals.php in administrator/index.php, Admin User Manager, and the poll m...

CVE-2008-6852

CVE-2008-6852 : SQL injection in Joomla! Ice Gallery component (com_ice) 0.5 beta 2. Remote attacker can execute arbitrary SQL via the catid parameter to index.php. Affected: Ice Gallery (com_ice) 0.5 beta 2 for Joomla!. Impact details and remediation not specified in the provided connected docum...

CVE-2006-4472

Joomla! is affected by CVE-2006-4472, with vulnerabilities in versions prior to 1.0.11 that allow attackers to bypass user authentication via the do_pdf command and emailform com_content task. The description indicates unknown vectors leading to authentication bypass, implying elevated access wit...

CVE-2011-4937

CVE-2011-4937 affects Joomla! 1.7.1 core code, causing information disclosure due to inadequate error checking. The vulnerability exposes partial confidentiality without evident exploitation details in the provided docs. References consistently describe core information disclosure in Joomla! 1.7....

CVE-2012-1562

CVE-2012-1562 affects Joomla! core prior to 2.5.3, allowing unauthorized password changes. This is corroborated by multiple sources (NVD, Red Hat, Nessus) in the provided documents. No concrete exploit details or remediation steps are present in the connected documents; remediation/version fixes ...

CVE-2006-4470

Joomla! prior to 1.0.11 omits a check for whether _VALID_MOS is defined, potentially enabling PHP remote file inclusion with unknown impact. The affected component is Joomla! (core PHP code path handling _VALID_MOS). Publicly available references describe the vulnerability as allowing an attacker...

CVE-2006-4471

CVE-2006-4471 : In Joomla! before 1.0.11, the Admin Upload Image feature allows remote authenticated users to upload files outside the /images/stories/ directory via unspecified vectors. Affected: Joomla! prior to 1.0.11. Root cause: insufficient enforcement of directory restrictions during image...

CVE-2015-4654

CVE-2015-4654 describes an SQL injection vulnerability in the Joomla! EQ Event Calendar component. The issue stems from inadequate filtering of the id parameter to eqfullevent, allowing remote attackers to execute arbitrary SQL commands. Documented references indicate this affects the EQ Event Ca...