Joomla! Project vulnerabilities, page 3

140 vulnerabilities

Known vulnerabilities in Joomla! Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.

5.3MediumCVE-2022-27912joomla! project · joomla! cms +1 more[20221001] - Core - Debug Mode leaks full request payloads including passwordsAn issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.EPSS0.62%6.1MediumCVE-2022-27914joomla! project · joomla! cms +1 more[20221101] - Core - RXSS through reflection of user input in com_mediaAn issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.EPSS0.50%6.1MediumCVE-2022-27913joomla! project · joomla! cms +1 more[20221002] - Core - RXSS through reflection of user input in headingsAn issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.EPSS0.44%9.8CriticalCVE-2022-23797joomla! project · joomla! cms +1 more[20220305] - Core - Inadequate filtering on the selected IdsAn issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.EPSS1.11%6.1MediumCVE-2022-23800joomla! project · joomla! cms +2 more[20220308] - Core - Inadequate content filtering within the filter codeAn issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.EPSS0.67%6.1MediumCVE-2022-23801joomla! project · joomla! cms +1 more[20220309] - Core - XSS attack vector through SVGAn issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.EPSS0.59%6.1MediumCVE-2022-23798joomla! project · joomla! cms +1 more[20220306] - Core - Inadequate validation of internal URLsAn issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.EPSS0.59%9.8CriticalCVE-2022-23795joomla! project · joomla! cms +1 more[20220303] - Core - User row are not bound to a authentication mechanismAn issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.EPSS1.15%6.1MediumCVE-2022-23796joomla! project · joomla! cms +1 more[20220304] - Core - Missing input validation within com_fields class inputsAn issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.EPSS0.59%7.5HighCVE-2022-23793joomla! project · joomla! cms +2 more[20220301] - Core - Zip Slip within the Tar extractorAn issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.EPSS2.08%9.8CriticalCVE-2022-23799joomla! project · joomla! cms +2 more[20220307] - Core - Variable Tampering on JInput $_REQUEST dataAn issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.EPSS1.23%5.3MediumCVE-2022-23794joomla! project · joomla! cms +2 more[20220302] - Core - Path Disclosure within filesystem error messagesAn issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.EPSS0.92%6.1MediumCVE-2024-21731joomla! project · joomla! cms +1 more[20240703] - Core - XSS in StringHelper::truncate methodImproper handling of input could lead to an XSS vector in the StringHelper::truncate method.EPSS0.44%6.3MediumCVE-2024-21722joomla! project · joomla! cms +1 more[20240201] - Core - Insufficient session expiration in MFA management viewsThe MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.EPSS0.51%6.5MediumCVE-2024-21726joomla! project · joomla! cms +1 more[20240205] - Core - Inadequate content filtering within the filter codeInadequate content filtering leads to XSS vulnerabilities in various components.EPSS48.84%6.1MediumCVE-2024-21724joomla! project · joomla! cms +1 more[20240203] - Core - XSS in media selection fieldsInadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.EPSS0.51%6.1MediumCVE-2024-21729joomla! project · joomla! cms +1 more[20240701] - Core - XSS in accessible media selection fieldInadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.EPSS0.44%6.1MediumCVE-2024-21725joomla! project · joomla! cms +1 more[20240204] - Core - XSS in mail address outputsInadequate escaping of mail addresses lead to XSS vulnerabilities in various components.EPSS32.21%4.3MediumCVE-2024-21723joomla! project · joomla! cms +1 more[20240202] - Core - Open redirect in installation applicationInadequate parsing of URLs could result into an open redirect.EPSS0.54%5.4MediumCVE-2024-21730joomla! project · joomla! cms +1 more[20240702] - Core - Self-XSS in fancyselect list field layoutThe fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.EPSS0.42%