CVE-2021-23125

[20210103] - Core - XSS in com_tags image parameters

An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23798

[20220306] - Core - Inadequate validation of internal URLs

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23800

[20220308] - Core - Inadequate content filtering within the filter code

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26035

[20210701] - Core - XSS in JForm Rules field

An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23795

[20220303] - Core - User row are not bound to a authentication mechanism

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26040

[20210801] - Core - Insufficient access control for com_media deletion endpoint

An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26034

[20210503] - Core - CSRF in data download endpoints

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26031

[20210402] - Core - Inadequate filters on module layout settings

An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26037

[20210703] - Core - Lack of enforced session termination

An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-23129

[20210303] - Core - XSS within alert messages showed to users

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23801

[20220309] - Core - XSS attack vector through SVG

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-23127

[20210301] - Core - Insecure randomness within 2FA secret generation

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

CVSS 3.1 · 9.1 Critical EPSS 1.4% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26029

[20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field

An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26032

[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload

An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26036

[20210702] - Core - DoS through usergroup table manipulation

An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23797

[20220305] - Core - Inadequate filtering on the selected Ids

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26028

[20210308] - Core - Path Traversal within joomla/archive zip class

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-23123

[20210101] - Core - com_modules exposes module names

An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or inaccessible modules.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-23130

[20210304] - Core - XSS within the feed parser library

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26027

[20210307] - Core - ACL violation within com_content frontend editing

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!