Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,686 results · page 10 of 34
Jul 18, 2025A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' CVE-2025-49484 · Other software · joomsky.com · reported by security@joomla.orgHigh 8.7
A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature.
- Product
- JS Jobs component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands.CVE-2025-26855 · Other software · joomcar.net · reported by security@joomla.orgCritical 9.8
A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands.
- Product
- Articles Calendar extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands.CVE-2025-26854 · Other software · joomcar.net · reported by security@joomla.orgCritical 9.8
A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands.
- Product
- Articles Good Search extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2025A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered.CVE-2025-49468 · Other software · nobossextensions.com · reported by security@joomla.orgHigh 8.6
A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via the id_module parameter.
- Product
- No Boss Calendar component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered.CVE-2025-49467 · Other software · jevents.net / GWE Systems Ltd · reported by security@joomla.orgCritical 9.3
A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.
- Product
- JEvents component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025A SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla was discovered.CVE-2025-32466 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 6.7
A SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.
- Product
- RSMediaGallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered.CVE-2025-32465 · Other software · rsjoomla.com · reported by security@joomla.orgHigh 8.5
A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered. It allows attackers to perform cross-site scripting (XSS) attacks via sending crafted payload.
- Product
- RSTickets! component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered.CVE-2025-30085 · Other software · rsjoomla.com · reported by security@joomla.orgCritical 9.2
Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered. The issue occurs within the submission export feature and requires administrative access to the export feature.
- Product
- RSform!Pro component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered.CVE-2025-30084 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 6.1
A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard.
- Product
- RSMail! component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered.CVE-2025-27754 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 6.5
A stored XSS vulnerability in RSBlog! component 1.11.6 - 1.14.4 for Joomla was discovered. The vulnerability allows authenticated users to inject malicious JavaScript into the plugin's resource. The injected payload is stored by the application and later executed when other users view the affected content.
- Product
- RSBlog component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A SQLi vulnerability in RSMediaGallery component 1.7.4 - 2.1.6 for Joomla was discovered.CVE-2025-27753 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 6.5
A SQLi vulnerability in RSMediaGallery component 1.7.4 - 2.1.6 for Joomla was discovered. The vulnerability is due to the use of unescaped user-supplied parameters in SQL queries within the dashboard component. This allows an authenticated attacker to inject malicious SQL code through unsanitized input fields, which are used directly in SQL queries. Exploiting this flaw can lead to unauthorized database access, data leakage, or modification of records.
- Product
- RSMediaGallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2025A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered.CVE-2025-27445 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 5.4
A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient sanitization of user-supplied input in file path parameters, allowing attackers to exploit directory traversal sequences (e.g., ../) to access sensitive files
- Product
- RSFirewall component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered.CVE-2025-27444 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 4.8
A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filter[dateFrom] GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin or editor privileges to inject arbitrary JavaScript code by crafting a malicious URL.
- Product
- RSform!Pro component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the productCVE-2025-25228 · Other software · virtuemart.net · reported by security@joomla.orgLow 3.8
A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend.
- Product
- Virtuemart component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvirtuemart.net
Apr 8, 2025Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2025-25227 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package.CVE-2025-25226 · Websites & servers · Joomla! Project · reported by security@joomla.orgCritical 9.8
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.
- Product
- Joomla! Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0.CVE-2025-2714 · Websites & servers · JoomlaUX · reported by VulDBMedium 5.3
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the argument plan_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JUX Real Estate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2025A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their CVE-2025-25225 · Other software · hikashop.com · reported by security@joomla.orgMedium 6.5
A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.
- Product
- Hikashop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhikashop.com
Mar 11, 2025Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentiallCVE-2025-22213 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.1
Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2025A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla.CVE-2025-2127 · Websites & servers · JoomlaUX · reported by VulDBMedium 5.3
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JUX Real Estate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2025A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical.CVE-2025-2126 · Websites & servers · JoomlaUX · reported by VulDBMedium 5.3
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the argument title leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- JUX Real Estate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute aCVE-2025-22212 · Other software · tassos.gr · reported by security@joomla.orgLow 2.7
A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend.
- Product
- Convert Forms component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary CVE-2025-22211 · Other software · webdesigner-profi.de · reported by security@joomla.orgLow 3.4
A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend.
- Product
- JoomShopping component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwebdesigner-profi.de
Feb 25, 2025A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL CVE-2025-22210 · Other software · hikashop.com · reported by security@joomla.orgHigh 7.2
A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.
- Product
- Hikashop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhikashop.com
Feb 18, 2025Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.CVE-2025-22207 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.7
Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2025A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commCVE-2025-22209 · Other software · joomsky.com · reported by security@joomla.orgMedium 4.7
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.
- Product
- JS Jobs component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2025A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commCVE-2025-22208 · Other software · joomsky.com · reported by security@joomla.orgMedium 4.7
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.
- Product
- JS Jobs component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commCVE-2025-22206 · Other software · joomsky.com · reported by security@joomla.orgMedium 4.7
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.
- Product
- JS Jobs component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddecrypt.lockerjoomsky.com
Feb 4, 2025Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.CVE-2025-22205 · Websites & servers · reported by security@joomla.orgHigh 7.5
Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadmiror-design-studio.com
Feb 4, 2025Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability.CVE-2025-22204 · Other software · regularlabs.com · reported by security@joomla.orgCritical 9.8
Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability.
- Product
- Sourcerer for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Improper Access Controls allows access to protected views.CVE-2024-40749 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Improper Access Controls allows access to protected views.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Lack of output escaping in the id attribute of menu lists.CVE-2024-40748 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Lack of output escaping in the id attribute of menu lists.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Various module chromes didn't properly process inputs, leading to XSS vectors.CVE-2024-40747 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Various module chromes didn't properly process inputs, leading to XSS vectors.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8.CVE-2024-40745 · Other software · tassos.gr · reported by security@joomla.orgMedium 5.4
Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8.
- Product
- Convert Forms component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8.CVE-2024-40744 · Other software · tassos.gr · reported by security@joomla.orgCritical 9.8
Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8.
- Product
- Convert Forms component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2024A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browseCVE-2024-40746 · Other software · hikashop.com · reported by security@joomla.orgMedium 5.4
A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description `parameter is not sanitised in the backend.
- Product
- HikaShop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.CVE-2024-40743 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Improper Access Controls allows backend users to overwrite their username when disallowed.CVE-2024-27187 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Improper Access Controls allows backend users to overwrite their username when disallowed.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.CVE-2024-27186 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.CVE-2024-27185 · Websites & servers · Joomla! Project · reported by security@joomla.orgCritical 9.1
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..CVE-2024-27184 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024XSS vulnerability in DJ-HelpfulArticles component for Joomla.CVE-2024-27183 · Other software · dj-extensions.com · reported by security@joomla.orgMedium 6.1
XSS vulnerability in DJ-HelpfulArticles component for Joomla.
- Product
- DJ-HelpfulArticles for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Jul 9, 2024The wrapper extensions do not correctly validate inputs, leading to XSS vectors.CVE-2024-26279 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jul 9, 2024The Custom Fields component not correctly filter inputs, leading to a XSS vector.CVE-2024-26278 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
The Custom Fields component not correctly filter inputs, leading to a XSS vector.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jul 9, 2024Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.CVE-2024-21731 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jul 9, 2024The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.CVE-2024-21730 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.4
The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jul 9, 2024Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.CVE-2024-21729 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jun 28, 2024Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used.CVE-2024-5737 · Other software · Nikola Vasilijevski · reported by cvd@cert.plMedium 6.3
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0.
- Product
- AdmirorFrames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages availaCVE-2024-5736 · Other software · Nikola Vasilijevski · reported by cvd@cert.plHigh 8.2
Server Side Request Forgery (SSRF) vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0.
- Product
- AdmirorFrames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root foCVE-2024-5735 · Other software · Nikola Vasilijevski · reported by cvd@cert.plMedium 6.3
Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0.
- Product
- AdmirorFrames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.