Joomla! Security Vulnerabilities and Issues — Joomla! CVE List

Lucene search

JoomlaJoomla!

42 matches found

CVE•added 2024/02/29 1:44 a.m.•6869 views

CVE-2024-21723

Inadequate parsing of URLs could result into an open redirect.

4.3CVSS6.5AI score0.00005EPSS

CVE•added 2015/09/18 4:59 p.m.•131 views

CVE-2015-6939

Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.6AI score0.0008EPSS

CVE•added 2019/01/16 8:29 a.m.•92 views

CVE-2019-6263

An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.

4.8CVSS5AI score0.00074EPSS

CVE•added 2011/07/27 8:55 p.m.•74 views

CVE-2011-2710

Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject ...

4.3CVSS5.7AI score0.00047EPSS

CVE•added 2018/05/22 3:29 p.m.•68 views

CVE-2018-11328

An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI containing a username and password when the Location: header cannot be used), a lack of escaping the user-info component of the URI could result in an XSS vulnerability.

4.7CVSS4.9AI score0.00058EPSS

CVE•added 2023/02/01 10:15 p.m.•68 views

CVE-2023-23751

An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs.

4.3CVSS4.4AI score0.00005EPSS

CVE•added 2018/10/09 9:29 p.m.•62 views

CVE-2018-17857

An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation.

4.3CVSS4.8AI score0.00049EPSS

CVE•added 2013/05/03 11:57 a.m.•59 views

CVE-2013-3056

Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors.

4CVSS6.5AI score0.00016EPSS

CVE•added 2018/05/22 3:29 p.m.•58 views

CVE-2018-11326

An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.

4.8CVSS5.1AI score0.00066EPSS

CVE•added 2017/09/20 6:29 p.m.•57 views

CVE-2017-14595

In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.

4.3CVSS6.6AI score0.00071EPSS

CVE•added 2017/11/10 2:29 a.m.•56 views

CVE-2017-16633

In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.

4.3CVSS4.6AI score0.0003EPSS

CVE•added 2013/05/03 11:57 a.m.•55 views

CVE-2013-3057

Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors.

4CVSS6.5AI score0.00005EPSS

CVE•added 2020/07/15 4:15 p.m.•55 views

CVE-2020-15697

An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.

4.3CVSS4.7AI score0.00009EPSS

CVE•added 2013/05/03 11:57 a.m.•54 views

CVE-2013-3267

Cross-site scripting (XSS) vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00021EPSS

CVE•added 2014/10/08 7:55 p.m.•54 views

CVE-2014-6631

Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.7AI score0.00028EPSS

CVE•added 2018/10/09 9:29 p.m.•54 views

CVE-2018-17859

An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disabled forms.

4.3CVSS4.9AI score0.00058EPSS

CVE•added 2012/09/06 9:55 p.m.•53 views

CVE-2012-1612

Cross-site scripting (XSS) vulnerability in the update manager in Joomla! 2.5.x before 2.5.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00011EPSS

CVE•added 2012/10/31 4:55 p.m.•53 views

CVE-2012-4531

Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00011EPSS

CVE•added 2013/05/03 11:57 a.m.•53 views

CVE-2013-3059

Cross-site scripting (XSS) vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00018EPSS

CVE•added 2018/05/22 3:29 p.m.•53 views

CVE-2018-11327

An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission.

4.3CVSS4.8AI score0.00015EPSS

CVE•added 2012/10/31 4:55 p.m.•52 views

CVE-2012-4532

Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. NOTE: some of these details are obtained from third party ...

4.3CVSS5.9AI score0.00022EPSS

CVE•added 2011/11/23 6:55 p.m.•50 views

CVE-2011-4332

Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.9AI score0.00022EPSS

CVE•added 2014/10/08 7:55 p.m.•50 views

CVE-2014-7982

Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.0002EPSS

CVE•added 2007/08/08 1:17 a.m.•47 views

CVE-2007-4189

Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.13 (aka Sunglow) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the (1) com_search, (2) com_content, and (3) mod_login components. NOTE: some of these details are obtained from third ...

4.3CVSS5.6AI score0.0002EPSS

CVE•added 2007/10/18 9:17 p.m.•47 views

CVE-2007-5577

Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.13 (aka Sunglow) allow remote attackers to inject arbitrary web script or HTML via the (1) Title or (2) Section Name form fields in the Section Manager component, or (3) multiple unspecified fields in New Menu Item.

4.3CVSS5.7AI score0.00038EPSS

CVE•added 2012/11/11 1:1 p.m.•46 views

CVE-2012-5827

Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving "Inadequate protection."

4.3CVSS6.8AI score0.00012EPSS

CVE•added 2014/10/20 2:55 p.m.•45 views

CVE-2012-2413

Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

4.3CVSS5.9AI score0.00035EPSS

CVE•added 2013/12/29 4:25 a.m.•45 views

CVE-2013-5583

Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

4.3CVSS5.8AI score0.00023EPSS

CVE•added 2013/05/03 11:57 a.m.•43 views

CVE-2013-3058

Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.7AI score0.00021EPSS

CVE•added 2007/08/08 1:17 a.m.•42 views

CVE-2007-4190

CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter. NOTE: this can be leveraged for cross-site scripting (XSS) attacks. NOTE: some o...

4.3CVSS5.9AI score0.00009EPSS

CVE•added 2012/09/06 7:55 p.m.•42 views

CVE-2012-0822

Cross-site scripting (XSS) vulnerability in Joomla! 1.6 and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0820.

4.3CVSS5.8AI score0.00015EPSS

CVE•added 2011/07/27 8:55 p.m.•41 views

CVE-2011-2509

Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component, a...

4.3CVSS5.8AI score0.00027EPSS

CVE•added 2012/09/06 7:55 p.m.•41 views

CVE-2012-0820

Cross-site scripting (XSS) vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0822.

4.3CVSS5.8AI score0.00015EPSS

CVE•added 2012/07/03 10:55 p.m.•40 views

CVE-2012-3828

Cross-site scripting (XSS) vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header.

4.3CVSS5.9AI score0.00022EPSS

CVE•added 2012/10/07 9:55 p.m.•39 views

CVE-2011-4910

Cross-site scripting (XSS) vulnerability in Joomla! before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

4.3CVSS5.9AI score0.00032EPSS

CVE•added 2010/10/28 12:0 a.m.•38 views

CVE-2010-3712

Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving "multiple encoded entities," as demonstrated by the query string to index.php in the com_weblinks or com_content compon...

4.3CVSS5.7AI score0.00039EPSS

CVE•added 2012/09/26 12:55 a.m.•38 views

CVE-2012-1117

Cross-site scripting (XSS) vulnerability in Joomla! 2.5.0 and 2.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00011EPSS

CVE•added 2010/06/08 12:30 a.m.•37 views

CVE-2010-1649

Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in administrator/index.php.

4.3CVSS5.9AI score0.00031EPSS

CVE•added 2011/07/27 8:55 p.m.•37 views

CVE-2011-2892

Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

4.3CVSS6.6AI score0.00017EPSS

CVE•added 2014/10/08 7:55 p.m.•36 views

CVE-2014-7983

Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.0003EPSS

CVE•added 2012/10/07 9:55 p.m.•33 views

CVE-2011-4909

Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML via the HTTP_REFERER header to (1) components/com_content/views/article/tmpl/form.php, (2) components/com_user/controller.php, (3) plugins/system/legacy/html.ph...

4.3CVSS5.9AI score0.00075EPSS

CVE•added 2012/10/22 11:55 p.m.•28 views

CVE-2012-5455

Cross-site scripting (XSS) vulnerability in the language search component in Joomla! before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "typographical error."

4.3CVSS5.9AI score0.00011EPSS