CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Joomla : Security Vulnerabilities (CVSS score between 4 and 4.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-16725 79 XSS 2019-09-24 2019-09-25
4.3
 None Remote Medium Not required None Partial None
In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
2 CVE-2019-12766 79 XSS 2019-06-11 2019-06-12
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors.
3 CVE-2019-12764 284 2019-06-11 2019-06-12
4.0
 None Remote Low Single system None Partial None
An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users.
4 CVE-2019-11809 79 XSS 2019-05-20 2019-05-20
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.
5 CVE-2019-6264 79 XSS 2019-01-16 2019-01-18
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability.
6 CVE-2019-6261 79 XSS 2019-01-16 2019-01-18
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.
7 CVE-2018-17859 2018-10-09 2019-10-02
4.0
 None Remote Low Single system None Partial None
An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disabled forms.
8 CVE-2018-17857 863 2018-10-09 2019-10-02
4.0
 None Remote Low Single system None Partial None
An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation.
9 CVE-2018-12711 79 XSS 2018-06-26 2018-08-20
4.3
 None Remote Medium Not required None Partial None
An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.
10 CVE-2018-11327 200 +Info 2018-05-22 2018-06-22
4.0
 None Remote Low Single system Partial None None
An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that were either unpublished or published with restricted view permission.
11 CVE-2018-11324 362 2018-05-22 2018-06-22
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core or extension updates, could create a race condition where a session that was expected to be destroyed would be recreated.
12 CVE-2018-11321 20 2018-05-22 2018-06-22
4.0
 None Remote Low Single system None Partial None
An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.
13 CVE-2018-6380 79 XSS 2018-01-30 2018-02-13
4.3
 None Remote Medium Not required None Partial None
In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.
14 CVE-2018-6379 79 XSS 2018-01-30 2018-02-13
4.3
 None Remote Medium Not required None Partial None
In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.
15 CVE-2018-6378 79 XSS 2018-05-22 2018-06-22
4.3
 None Remote Medium Not required None Partial None
In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.
16 CVE-2018-6377 79 XSS 2018-01-30 2018-02-13
4.3
 None Remote Medium Not required None Partial None
In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox
17 CVE-2017-16633 200 +Info 2017-11-09 2017-11-28
4.0
 None Remote Low Single system Partial None None
In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.
18 CVE-2017-14595 2017-09-20 2019-10-02
4.3
 None Remote Medium Not required Partial None None
In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.
19 CVE-2017-11612 79 XSS 2017-07-26 2017-07-31
4.3
 None Remote Medium Not required None Partial None
In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.
20 CVE-2017-9934 79 XSS CSRF 2017-07-17 2017-07-21
4.3
 None Remote Medium Not required None Partial None
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
21 CVE-2017-7989 434 2017-04-25 2017-05-02
4.0
 None Remote Low Single system None Partial None
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden.
22 CVE-2017-7987 79 XSS 2017-04-25 2017-05-03
4.3
 None Remote Medium Not required None Partial None
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component.
23 CVE-2017-7986 79 XSS 2017-04-25 2017-05-02
4.3
 None Remote Medium Not required None Partial None
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components.
24 CVE-2017-7985 79 XSS 2017-04-25 2017-09-20
4.3
 None Remote Medium Not required None Partial None
In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components.
25 CVE-2017-7984 79 XSS 2017-04-25 2017-05-02
4.3
 None Remote Medium Not required None Partial None
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering leads to XSS in the template manager component.
26 CVE-2015-6939 79 XSS 2015-09-18 2016-12-08
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
27 CVE-2014-7983 79 XSS 2014-10-08 2014-10-09
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
28 CVE-2014-7982 79 XSS 2014-10-08 2014-10-09
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
29 CVE-2014-6631 79 XSS 2014-10-08 2014-10-09
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
30 CVE-2014-0794 79 1 Exec Code Sql XSS 2014-01-26 2018-10-09
4.3
 None Remote Medium Not required None Partial None
SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php.
31 CVE-2013-5583 79 XSS 2013-12-28 2016-12-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
32 CVE-2013-3267 79 XSS 2013-05-03 2013-05-03
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
33 CVE-2013-3059 79 XSS 2013-05-03 2013-05-03
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
34 CVE-2013-3058 79 XSS 2013-05-03 2013-05-03
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
35 CVE-2013-3057 264 Bypass 2013-05-03 2013-05-03
4.0
 None Remote Low Single system Partial None None
Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors.
36 CVE-2013-3056 264 Bypass 2013-05-03 2013-05-03
4.0
 None Remote Low Single system None None Partial
Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors.
37 CVE-2012-5827 2012-11-11 2017-08-28
4.3
 None Remote Medium Not required None Partial None
Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving "Inadequate protection."
38 CVE-2012-5455 79 XSS 2012-10-22 2017-08-28
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the language search component in Joomla! before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "typographical error."
39 CVE-2012-4532 79 XSS 2012-10-31 2012-11-01
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. NOTE: some of these details are obtained from third party information.
40 CVE-2012-4531 79 XSS 2012-10-31 2017-08-28
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
41 CVE-2012-3828 79 1 XSS 2012-07-03 2017-08-28
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header.
42 CVE-2012-2413 79 XSS 2014-10-20 2017-08-28
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.
43 CVE-2012-1612 79 XSS 2012-09-06 2012-09-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the update manager in Joomla! 2.5.x before 2.5.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
44 CVE-2012-1117 79 XSS 2012-09-25 2017-08-28
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! 2.5.0 and 2.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
45 CVE-2012-0822 79 XSS 2012-09-06 2012-09-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! 1.6 and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0820.
46 CVE-2012-0820 79 XSS 2012-09-06 2012-09-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0822.
47 CVE-2011-4910 79 XSS 2012-10-07 2012-10-08
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Joomla! before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
48 CVE-2011-4909 79 XSS 2012-10-07 2012-10-08
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML via the HTTP_REFERER header to (1) components/com_content/views/article/tmpl/form.php, (2) components/com_user/controller.php, (3) plugins/system/legacy/html.php, or (4) templates/beez/html/com_content/article/form.php.
49 CVE-2011-4332 79 XSS 2011-11-23 2011-11-28
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
50 CVE-2011-2892 20 2011-07-27 2011-07-29
4.3
 None Remote Medium Not required None Partial None
Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Total number of vulnerabilities : 71   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.