Joomla

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

An improper access check allows unauthorized users to access com_privacy datasets.

An improper access check allows users to display a list of modules in the frontend.

An improper access check allows unauthorized users to access workflow stage and transition information.

Improper validation leads to a generic XSS vector in the language override feature.

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

Lack of validation leads to an XSS vulnerability in the MFA management views.

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

An improper access check allows privileged users to overwrite media files without editing permissions.

Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers t

Lack of input filtering leads to an XSS vector in the HTML filter code.

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't e

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.

An improper access check allows privilege escalation through the com_users batch task.

An improper access check allows privilege escalation through the com_users batch task.

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerabili

An improper validation of user-supplied input leads to a local file inclusion vulnerability.

An improper access check allows unauthorized access to com_config webservice endpoints.

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

Lack of output escaping leads to a XSS vector in the readmore links for com_content.

Lack of output escaping leads to a XSS vector in the content history component.

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Lack of output escaping leads to a XSS vector in the feed modules.

An improper access check allows unauthorized access to webservice endpoints.

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

Lack of output escaping for article titles leads to XSS vectors in various locations.

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was pote

Lack of output escaping leads to a XSS vector in the pagebreak plugin.

Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.