Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 669

Export CSV
CVE-2021-23128

[20210302] - Core - Potential Insecure FOFEncryptRandval

An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.

CVSS 3.1 · 9.1 Critical EPSS 1.4% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2022-23794

[20220302] - Core - Path Disclosure within filesystem error messages

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2021-26038

[20210704] - Core - Privilege escalation through com_installer

An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for com_installer is limited to super users already.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2022-23799

[20220307] - Core - Variable Tampering on JInput $_REQUEST data

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2021-26033

[20210502] - Core - CSRF in AJAX reordering endpoint

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2021-23124

[20210102] - Core - XSS in mod_breadcrumbs aria-label attribute

An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks.

CVSS 3.1 · 6.1 Medium EPSS 79.0% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2022-27911

[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'

An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2022-23796

[20220304] - Core - Missing input validation within com_fields class inputs

An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2021-26039

[20210705] - Core - XSS in com_media imagelist

An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2022-23793

[20220301] - Core - Zip Slip within the Tar extractor

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2021-23126

[20210301] - Core - Insecure randomness within 2FA secret generation

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2021-23131

[20210305] - Core - Input validation within the template manager

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2021-26030

[20210401] - Core - Escape xss in logo parameter error pages

An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page

CVSS 3.1 · 6.1 Medium EPSS 82.8% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2020-35612

[20201103] - Core - Path traversal in mod_random_image

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validation, leading to a path traversal vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2020-35614

[20201105] - Core - User Enumeration in backend login

An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2020-35611

[20201102] - Core - Disclosure of secrets in Global Configuration page

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2020-35615

[20201106] - Core - CSRF in com_privacy emailexport feature

An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2020-35613

[20201104] - Core - SQL injection in com_users list view

An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list.

CVSS 3.1 · 9.8 Critical EPSS 28.9% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2020-35616

[20201107] - Core - Write ACL violation in multiple core views

An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations.

CVSS 3.1 · 7.5 High EPSS 6.3% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2020-35610

[20201101] - Core - com_finder ignores access levels on autosuggest

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the access level of the corresponding terms.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Joomla
Products
Joomla\!