Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,686 results · page 11 of 34
Apr 24, 2024FG Joomla to: Insertion of Sensitive Information into Log FileCVE-2024-32788 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Joomla to WordPress.This issue affects FG Joomla to WordPress: from n/a through 4.20.2.
- Product
- FG Joomla to
- Affected
- up to 4.20.2
- What to do
- Affects up to 4.20.2. Update FG Joomla to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2024Inadequate content filtering leads to XSS vulnerabilities in various components.CVE-2024-21726 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.5
Inadequate content filtering leads to XSS vulnerabilities in various components.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgsonarsource.com
Feb 28, 2024Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.CVE-2024-21725 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Feb 28, 2024Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.CVE-2024-21724 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Feb 28, 2024Inadequate parsing of URLs could result into an open redirect.CVE-2024-21723 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 4.3
Inadequate parsing of URLs could result into an open redirect.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Feb 28, 2024The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.CVE-2024-21722 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.3
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Feb 15, 2024An Open Redirect vulnerability was found in osTicky2 below 2.2.8.CVE-2024-21728 · Other software · smartcalc.es · reported by security@joomla.orgMedium 6.1
An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return parameter in the URL to a base64 malicious URL.
- Product
- osTicky component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2024XSS vulnerability in DP Calendar component for Joomla.CVE-2024-21727 · Other software · digital-peak.com · reported by security@joomla.orgMedium 6.1
XSS vulnerability in DP Calendar component for Joomla.
- Product
- DP Calendar for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023SQLi vulnerability in Starshop component for Joomla.CVE-2023-49708 · Other software · Joomstar.com · reported by security@joomla.orgCritical 9.8
SQLi vulnerability in Starshop component for Joomla.
- Product
- Starshop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023SQLi vulnerability in S5 Register module for Joomla.CVE-2023-49707 · Websites & servers · joomlart.com · reported by security@joomla.orgCritical 9.8
SQLi vulnerability in S5 Register module for Joomla.
- Product
- S5 Register module for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla.CVE-2023-40659 · Other software · joomboost.com · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla.
- Product
- Easy Quick Contact module for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla.CVE-2023-40658 · Other software · deconf.net · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla.
- Product
- Clicky Analytics Dashboard module for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla.CVE-2023-40657 · Other software · artio.net · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla.
- Product
- Joomdoc component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the Quickform component for Joomla.CVE-2023-40656 · Other software · plasma-web.ru · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Quickform component for Joomla.
- Product
- Quickform component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.CVE-2023-40655 · Other software · mooj.org · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.
- Product
- Proforms Basic component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023Unauthenticated LFI/SSRF in JCDashboards component for Joomla.CVE-2023-40630 · Other software · joomcode.com · reported by security@joomla.orgCritical 9.8
Unauthenticated LFI/SSRF in JCDashboards component for Joomla.
- Product
- JCDashboards component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023SQLi vulnerability in LMS Lite component for Joomla.CVE-2023-40629 · Other software · king-products.net · reported by security@joomla.orgCritical 9.8
SQLi vulnerability in LMS Lite component for Joomla.
- Product
- LMS Lite component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.CVE-2023-40628 · Other software · Extplorer.net · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.
- Product
- Extplorer component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Dec 14, 2023A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.CVE-2023-40627 · Other software · https://github.com/MLWebTechnologies · reported by security@joomla.orgMedium 6.1
A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.
- Product
- LivingWord component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Nov 29, 2023The language file parsing process could be manipulated to expose environment variables.CVE-2023-40626 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Aug 17, 2023Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla.CVE-2023-39974 · Other software · acymailing.com · reported by security@joomla.orgMedium 5.3
Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list.
- Product
- AcyMailing Enterprise component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgacymailing.com
Aug 17, 2023Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla.CVE-2023-39973 · Other software · acymailing.com · reported by security@joomla.orgMedium 4.3
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns.
- Product
- AcyMailing Enterprise component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgacymailing.com
Aug 17, 2023Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla.CVE-2023-39972 · Other software · acymailing.com · reported by security@joomla.orgMedium 4.3
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists.
- Product
- AcyMailing Enterprise component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgacymailing.com
Aug 17, 2023Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS.CVE-2023-39971 · Other software · acymailing.com · reported by security@joomla.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3.
- Product
- AcyMailing Enterprise component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgacymailing.com
Aug 17, 2023Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla.CVE-2023-39970 · Other software · acymailing.com · reported by security@joomla.orgCritical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution.
- Product
- AcyMailing component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Aug 7, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla.CVE-2023-38045 · Other software · admiror-design-studio.com · reported by security@joomla.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.
- Product
- Admiror Gallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Aug 7, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-38044 · Other software · hikashop.com · reported by security@joomla.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
- Product
- HikaShop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orghikashop.com
Aug 7, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-34477 · Other software · braincert.com · reported by security@joomla.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
- Product
- Virtual Classroom component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Aug 7, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-34476 · Other software · mooj.org · reported by security@joomla.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
- Product
- Proforms Basic component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Aug 7, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-23758 · Other software · creative-solutions.net · reported by security@joomla.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
- Product
- Creative Gallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Aug 7, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-23757 · Other software · bestaddon.com · reported by security@joomla.orgCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
- Product
- BA Gallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Jul 11, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla.CVE-2023-23756 · Other software · advcomsys.com · reported by security@joomla.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.
- Product
- oneVote component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
May 30, 2023An issue was discovered in Joomla! 4.2.0 through 4.3.1.CVE-2023-23755 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
May 30, 2023An issue was discovered in Joomla! 4.2.0 through 4.3.1.CVE-2023-23754 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Apr 23, 2023The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query.CVE-2023-23753 · Other software · vi-solutions · reported by security@joomla.orgCritical 9.8
The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.
- Product
- Visforms Base Package for Joomla 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.asturhackers.esvi-solutions.de
Mar 30, 2023AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when accesCVE-2023-28733 · Other software · AcyMailing · reported by vulnerability@ncsc.chHigh 7.2
AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
- Product
- Newsletter Plugin for Joomla in the Enterprise version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacymailing.combugbounty.ch
Mar 30, 2023Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system CVE-2023-28732 · Other software · AcyMailing · reported by vulnerability@ncsc.chMedium 6.5
Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.
- Product
- Newsletter Plugin for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comacymailing.com
Mar 30, 2023AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrCVE-2023-28731 · Other software · AcyMailing · reported by vulnerability@ncsc.chCritical 9.8
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
- Product
- Newsletter Plugin for Joomla in the Enterprise version
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacymailing.combugbounty.ch
Feb 16, 2023Joomla! Improper Access Control VulnerabilityCVE-2023-23752 · Websites & servers · Joomla! · reported by security@joomla.orgExploitedMedium 5.3
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
- Product
- Joomla!
- On CISA’s list since
- Jan 8, 2024 (federal fix deadline Jan 29, 2024)
- What to do
- Attackers are using this now. Install Joomla!’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdeveloper.joomla.orgdeveloper.joomla.org
Feb 1, 2023An issue was discovered in Joomla! 4.0.0 through 4.2.4.CVE-2023-23751 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 4.3
An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Feb 1, 2023An issue was discovered in Joomla! 4.0.0 through 4.2.6.CVE-2023-23750 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.3
An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jan 8, 2023A vulnerability was found in mrtnmtth joomla_mod_einsatz_stats up to 0.2.CVE-2016-15016 · Other software · mrtnmtth · reported by VulDBMedium 5.5
A vulnerability was found in mrtnmtth joomla_mod_einsatz_stats up to 0.2. It has been classified as critical. This affects the function getStatsByType of the file helper.php. The manipulation of the argument year leads to sql injection. Upgrading to version 0.3 is able to address this issue. The identifier of the patch is 27c1b443cff45c81d9d7d926a74c76f8b6ffc6cb. It is recommended to upgrade the affected component. The identifier VDB-217653 was assigned to this vulnerability.
- Product
- joomla_mod_einsatz_stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023A vulnerability classified as critical was found in gesellix titlelink on Joomla.CVE-2010-10003 · Other software · gesellix · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugin_content_title.php. The manipulation of the argument phrase leads to sql injection. The patch is named b4604e523853965fa981a4e79aef4b554a535db0. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217351.
- Product
- titlelink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022An issue was discovered in Joomla! 4.0.0 through 4.2.4.CVE-2022-27914 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Oct 25, 2022An issue was discovered in Joomla! 4.2.0 through 4.2.3.CVE-2022-27913 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Oct 25, 2022An issue was discovered in Joomla! 4.0.0 through 4.2.3.CVE-2022-27912 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.3
An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Aug 31, 2022An issue was discovered in Joomla! 4.2.0.CVE-2022-27911 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.3
An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jul 10, 2022In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload fuCVE-2022-27910 · Websites & servers · Joomlatools · reported by security@joomla.orgMedium 6.1
In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function
- Product
- DOCman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomlatools.comjoomlatools.com
May 6, 2022In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' filesCVE-2022-27909 · Other software · jDownloads · reported by security@joomla.orgMedium 4.3
In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files
- Product
- jDownloads
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerhood.redhotcyber.comjdownloads.com
May 6, 2022Joomla Guru extension 5.2.5 is affected by: Insecure Permissions.CVE-2022-23802 · Other software · ijoomla.com · reported by security@joomla.orgHigh 7.5
Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information (remote). The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components, possibility to view other users' information.
- Product
- Guru
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordguru.ijoomla.comguru.ijoomla.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.