Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,224 results · page 5 of 25
Apr 21, 2020An issue was discovered in Joomla! before 3.9.17.CVE-2020-11889 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10243 · Websites & servers · Joomla · reported by MITRECritical 9.8
An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10242 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10241 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10240 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10239 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Mar 16, 2020An issue was discovered in Joomla! before 3.9.16.CVE-2020-10238 · Websites & servers · Joomla · reported by MITREHigh 7.5
An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Mar 4, 2020An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!.CVE-2020-9364 · Other software · Creative-solutions · reported by MITREMedium 5.3
An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the "Send me a copy" option to receive any files of the filesystem via email.
- Product
- Creative Contact Form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 12, 2020TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.CVE-2011-4908 · Websites & servers · Joomla! · reported by Red HatCritical 9.8
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.
- Product
- TinyBrowser Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulmon.comexploit-db.com
Feb 12, 2020Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.CVE-2011-4906 · Websites & servers · Joomla! · reported by Red HatCritical 9.8
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.
- Product
- Tiny browser included with TinyMCE 3.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgexploit-db.com
Feb 5, 2020Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.CVE-2011-1151 · Websites & servers · Joomla! · reported by Red HatCritical 9.1
Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Feb 4, 2020Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.CVE-2011-4912 · Websites & servers · Joomla! · reported by Red HatMedium 5.3
Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgopenwall.com
Feb 4, 2020Joomla! 1.7.1 has core information disclosure due to inadequate error checking.CVE-2011-4937 · Websites & servers · Joomla! · reported by Red HatHigh 7.5
Joomla! 1.7.1 has core information disclosure due to inadequate error checking.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 4, 2020Joomla! core 1.7.1 allows information disclosure due to weak encryptionCVE-2011-3629 · Websites & servers · Joomla! · reported by Red HatHigh 7.5
Joomla! core 1.7.1 allows information disclosure due to weak encryption
- Product
- Joomla! core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 3, 2020The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing.CVE-2020-5182 · Other software · Cmsjunkie · reported by MITREMedium 6.5
The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" (or similar attributes such as noreferrer), the tabnabbing may occur. To reproduce the bug, create a business with a website link that contains JavaScript to exploit the window.opener property (for example, by setting window.opener.location).
- Product
- J-businessdirectory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcmsjunkie.comcmsjunkie.com
Jan 28, 2020An issue was discovered in Joomla! before 3.9.15.CVE-2020-8421 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jan 28, 2020An issue was discovered in Joomla! before 3.9.15.CVE-2020-8420 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jan 28, 2020An issue was discovered in Joomla! before 3.9.15.CVE-2020-8419 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jan 22, 2020Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.CVE-2011-3595 · Websites & servers · Joomla! · reported by Red HatMedium 5.4
Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2020Joomla! 1.5x through 1.5.12: Missing JEXEC CheckCVE-2011-4907 · Websites & servers · Joomla! · reported by Red HatMedium 5.3
Joomla! 1.5x through 1.5.12: Missing JEXEC Check
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgopenwall.com
Jan 15, 2020Joomla! before 2.5.3 allows Admin Account Creation.CVE-2012-1563 · Websites & servers · Joomla! · reported by Red HatHigh 7.5
Joomla! before 2.5.3 allows Admin Account Creation.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdeveloper.joomla.org
Jan 15, 2020Joomla! core before 2.5.3 allows unauthorized password change.CVE-2012-1562 · Websites & servers · Joomla! · reported by Red HatHigh 7.5
Joomla! core before 2.5.3 allows unauthorized password change.
- Product
- Joomla! core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdeveloper.joomla.org
Jan 2, 2020SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permissiCVE-2013-3932 · Other software · Jomres · reported by PSIRT-CNA@flexerasoftware.comHigh 8.8
SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to execute arbitrary SQL commands via the id parameter in an editProfile action to administrator/index.php.
- Product
- Jomres component for Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Jan 2, 2020Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business ManaCVE-2013-3931 · Other software · Jomres · reported by PSIRT-CNA@flexerasoftware.comMedium 5.4
Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to inject arbitrary web script or HTML via the property_name parameter, related to editing property details.
- Product
- Jomres component for Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Dec 19, 2019dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobCVE-2019-17527 · Other software · Joomsky · reported by MITRECritical 9.8
dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter.
- Product
- JS Jobs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 17, 2019In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.CVE-2019-19846 · Websites & servers · Joomla · reported by MITRECritical 9.8
In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Dec 17, 2019In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.CVE-2019-19845 · Websites & servers · Joomla · reported by MITREMedium 5.3
In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Dec 17, 2019class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the CVE-2019-19634 · Websites & servers · reported by MITRECritical 9.8
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2019class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the sCVE-2019-19576 · Websites & servers · reported by MITRECritical 9.8
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 22, 2019The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/seCVE-2013-6879 · Other software · Miwisoft · reported by MITREMedium 5.3
The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message.
- Product
- Mijosearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Nov 22, 2019Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web scriCVE-2013-6878 · Other software · Miwisoft · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search.
- Product
- Mijosearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhtbridge.comhtbridge.com
Nov 13, 2019views/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary filCVE-2014-1214 · Other software · Projoom · reported by MITREHigh 8.8
views/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary files via a crafted (1) dest parameter and (2) arbitrary extension in the Filename parameter.
- Product
- Smart Flash Header
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comportcullis-security.com
Nov 5, 2019An issue was discovered in Joomla! before 3.9.13.CVE-2019-18674 · Websites & servers · Joomla · reported by MITREMedium 5.3
An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Nov 5, 2019An issue was discovered in Joomla! before 3.9.13.CVE-2019-18650 · Websites & servers · Joomla · reported by MITREHigh 8.8
An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Oct 29, 2019Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remoteCVE-2018-10727 · Other software · Fabrikar · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header.
- Product
- Fabrik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2019The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.CVE-2019-17399 · Websites & servers · Joomlashack · reported by MITRECritical 9.8
The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.
- Product
- Shack Forms Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomlashack.comjoomlashack.com
Sep 24, 2019In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.CVE-2019-16725 · Websites & servers · Joomla · reported by MITREMedium 6.1
In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Aug 16, 2019The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.CVE-2019-15120 · Other software · Kunena · reported by MITREMedium 5.4
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
- Product
- Kunena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvel.joomla.org
Aug 14, 2019In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.CVE-2019-15028 · Websites & servers · Joomla · reported by MITREMedium 5.3
In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Aug 4, 2019In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated oCVE-2019-14654 · Websites & servers · Joomla · reported by MITREHigh 8.8
In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
Jun 19, 2019SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATH_INFO to mydeals/ or listdeals/.CVE-2018-17386 · Other software · Thephpfactory · reported by MITRECritical 9.8
SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATH_INFO to mydeals/ or listdeals/.
- Product
- Micro Deal Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 19, 2019SQL Injection exists in the Dutch Auction Factory 2.0.2 component for Joomla! via the filter_order_Dir or filter_order parameter.CVE-2018-17381 · Other software · Thephpfactory · reported by MITRECritical 9.8
SQL Injection exists in the Dutch Auction Factory 2.0.2 component for Joomla! via the filter_order_Dir or filter_order parameter.
- Product
- Dutch Auction Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 19, 2019SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filter_order_Dir or filter_order parameter.CVE-2018-17374 · Other software · Thephpfactory · reported by MITRECritical 9.8
SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filter_order_Dir or filter_order parameter.
- Product
- Auction Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 19, 2019SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter.CVE-2018-17399 · Other software · Jimtawl Project · reported by MITRECritical 9.8
SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter.
- Product
- Jimtawl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 19, 2019SQL Injection exists in the AMGallery 1.2.3 component for Joomla! via the filter_category_id parameter.CVE-2018-17398 · Other software · Arenam · reported by MITRECritical 9.8
SQL Injection exists in the AMGallery 1.2.3 component for Joomla! via the filter_category_id parameter.
- Product
- Amgallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 11, 2019An issue was discovered in Joomla! before 3.9.7.CVE-2019-12766 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdeveloper.joomla.org
Jun 11, 2019An issue was discovered in Joomla! before 3.9.7.CVE-2019-12765 · Websites & servers · Joomla · reported by MITRECritical 9.8
An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdeveloper.joomla.org
Jun 11, 2019An issue was discovered in Joomla! before 3.9.7.CVE-2019-12764 · Websites & servers · Joomla · reported by MITREMedium 6.5
An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comdeveloper.joomla.org
May 20, 2019An issue was discovered in Joomla! before 3.9.6.CVE-2019-11809 · Websites & servers · Joomla · reported by MITREMedium 6.1
An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.
- Product
- Joomla!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orgdeveloper.joomla.org
May 9, 2019https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection.CVE-2017-12758 · Websites & servers · Joomlaextensions · reported by MITRECritical 9.8
https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. The impact is: Code execution (remote). The component is: com_appointment component.
- Product
- Component Appointment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomlaextension.bizexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.