Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,686 results · page 13 of 34

Sep 1, 2020gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions.CVE-2020-23971 · Other software · Gmapfp · reported by MITREHigh 7.5
gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions. An attacker can access the upload function without authenticating to the application and also can upload files due the issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.
Product
Gmapfp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 27, 2020In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload fCVE-2020-23972 · Other software · Gmapfp · reported by MITREHigh 7.5
In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload files which due to issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.
Product
Gmapfp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com raw.githubusercontent.com
Aug 26, 2020An issue was discovered in Joomla! before 3.9.21.CVE-2020-24599 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Aug 26, 2020An issue was discovered in Joomla! before 3.9.21.CVE-2020-24598 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jul 15, 2020An issue was discovered in Joomla! through 3.9.19.CVE-2020-15700 · Websites & servers · Joomla · reported by MITREMedium 6.3
An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jul 15, 2020An issue was discovered in Joomla! through 3.9.19.CVE-2020-15699 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site configuration.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jul 15, 2020An issue was discovered in Joomla! through 3.9.19.CVE-2020-15698 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jul 15, 2020An issue was discovered in Joomla! through 3.9.19.CVE-2020-15697 · Websites & servers · Joomla · reported by MITREMedium 4.3
An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jul 15, 2020An issue was discovered in Joomla! through 3.9.19.CVE-2020-15696 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jul 15, 2020An issue was discovered in Joomla! through 3.9.19.CVE-2020-15695 · Websites & servers · Joomla · reported by MITREMedium 6.3
An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jun 9, 2020The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager.CVE-2020-13996 · Other software · J2store · reported by MITREHigh 8.8
The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager.
Product
J2store
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record j2store.org j2store.org
Jun 2, 2020In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.CVE-2020-13763 · Websites & servers · Joomla · reported by MITREHigh 7.5
In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jun 2, 2020In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.CVE-2020-13762 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jun 2, 2020In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.CVE-2020-13761 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jun 2, 2020In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.CVE-2020-13760 · Websites & servers · Joomla · reported by MITREHigh 8.8
In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
May 23, 2020The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure.CVE-2020-13424 · Other software · Xcloner · reported by MITREMedium 6.5
The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure.
Product
Xcloner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xcloner.com xcloner.com
Apr 21, 2020An issue was discovered in Joomla! before 3.9.17.CVE-2020-11891 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Apr 21, 2020An issue was discovered in Joomla! before 3.9.17.CVE-2020-11890 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Apr 21, 2020An issue was discovered in Joomla! before 3.9.17.CVE-2020-11889 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10243 · Websites & servers · Joomla · reported by MITRECritical 9.8
An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10242 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10241 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10240 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10239 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10238 · Websites & servers · Joomla · reported by MITREHigh 7.5
An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Mar 9, 2020JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.CVE-2015-7342 · Other software · Joobi · reported by MITREHigh 7.2
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
Product
Jnews
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.integrity.pt labs.integrity.pt
Mar 9, 2020JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.CVE-2015-7341 · Other software · Joobi · reported by MITREHigh 8.8
JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
Product
Jnews
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.integrity.pt labs.integrity.pt
Mar 9, 2020JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.CVE-2015-7340 · Other software · Gwesystems · reported by MITREHigh 7.2
JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
Product
Jevents
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.integrity.pt labs.integrity.pt
Mar 9, 2020JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.phCVE-2015-7339 · Other software · Widgetfactorylimited · reported by MITREHigh 8.8
JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.php script.
Product
JCE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.integrity.pt labs.integrity.pt
Mar 9, 2020SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php.CVE-2015-7338 · Other software · Acyba · reported by MITREHigh 7.2
SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php.
Product
Acymailing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.integrity.pt labs.integrity.pt
Mar 9, 2020HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].CVE-2015-7344 · Other software · Hikashop · reported by MITREMedium 4.8
HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
Product
Hikashop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.integrity.pt labs.integrity.pt
Mar 9, 2020JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.CVE-2015-7343 · Other software · Joobi · reported by MITREMedium 4.8
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
Product
Jnews
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.integrity.pt labs.integrity.pt
Mar 4, 2020An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!.CVE-2020-9364 · Other software · Creative-solutions · reported by MITREMedium 5.3
An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the "Send me a copy" option to receive any files of the filesystem via email.
Product
Creative Contact Form
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 12, 2020TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.CVE-2011-4908 · Websites & servers · Joomla! · reported by Red HatCritical 9.8
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.
Product
TinyBrowser Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulmon.com exploit-db.com
Feb 12, 2020Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.CVE-2011-4906 · Websites & servers · Joomla! · reported by Red HatCritical 9.8
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.
Product
Tiny browser included with TinyMCE 3.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org exploit-db.com
Feb 5, 2020Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.CVE-2011-1151 · Websites & servers · Joomla! · reported by Red HatCritical 9.1
Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Feb 4, 2020Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.CVE-2011-4912 · Websites & servers · Joomla! · reported by Red HatMedium 5.3
Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org openwall.com
Feb 4, 2020Joomla! 1.7.1 has core information disclosure due to inadequate error checking.CVE-2011-4937 · Websites & servers · Joomla! · reported by Red HatHigh 7.5
Joomla! 1.7.1 has core information disclosure due to inadequate error checking.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Feb 4, 2020Joomla! core 1.7.1 allows information disclosure due to weak encryptionCVE-2011-3629 · Websites & servers · Joomla! · reported by Red HatHigh 7.5
Joomla! core 1.7.1 allows information disclosure due to weak encryption
Product
Joomla! core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Feb 3, 2020The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing.CVE-2020-5182 · Other software · Cmsjunkie · reported by MITREMedium 6.5
The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" (or similar attributes such as noreferrer), the tabnabbing may occur. To reproduce the bug, create a business with a website link that contains JavaScript to exploit the window.opener property (for example, by setting window.opener.location).
Product
J-businessdirectory
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cmsjunkie.com cmsjunkie.com
Jan 28, 2020An issue was discovered in Joomla! before 3.9.15.CVE-2020-8421 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jan 28, 2020An issue was discovered in Joomla! before 3.9.15.CVE-2020-8420 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jan 28, 2020An issue was discovered in Joomla! before 3.9.15.CVE-2020-8419 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org developer.joomla.org
Jan 22, 2020Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.CVE-2011-3595 · Websites & servers · Joomla! · reported by Red HatMedium 5.4
Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record yehg.net openwall.com
Jan 15, 2020Joomla! 1.5x through 1.5.12: Missing JEXEC CheckCVE-2011-4907 · Websites & servers · Joomla! · reported by Red HatMedium 5.3
Joomla! 1.5x through 1.5.12: Missing JEXEC Check
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.joomla.org openwall.com
Jan 15, 2020Joomla! before 2.5.3 allows Admin Account Creation.CVE-2012-1563 · Websites & servers · Joomla! · reported by Red HatHigh 7.5
Joomla! before 2.5.3 allows Admin Account Creation.
Product
Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com developer.joomla.org
Jan 15, 2020Joomla! core before 2.5.3 allows unauthorized password change.CVE-2012-1562 · Websites & servers · Joomla! · reported by Red HatHigh 7.5
Joomla! core before 2.5.3 allows unauthorized password change.
Product
Joomla! core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com developer.joomla.org
Jan 2, 2020SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permissiCVE-2013-3932 · Other software · Jomres · reported by PSIRT-CNA@flexerasoftware.comHigh 8.8
SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to execute arbitrary SQL commands via the id parameter in an editProfile action to administrator/index.php.
Product
Jomres component for Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jan 2, 2020Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business ManaCVE-2013-3931 · Other software · Jomres · reported by PSIRT-CNA@flexerasoftware.comMedium 5.4
Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to inject arbitrary web script or HTML via the property_name parameter, related to editing property details.
Product
Jomres component for Joomla!
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Dec 19, 2019dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobCVE-2019-17527 · Other software · Joomsky · reported by MITRECritical 9.8
dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter.
Product
JS Jobs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.