CVE-2011-2509
published 2011-07-27CVE-2011-2509: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query…
PriorityP415medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.09%
61.2th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component, as demonstrated by the filter_order parameter to index.php; (3) the query string to the com_newsfeeds component, as demonstrated by an arbitrary parameter to index.php; or (4) the option parameter in a reset.request action to index.php; and, when Internet Explorer or Konqueror is used, (5) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| joomla | joomla-cms | >= 0 < 1.6.4 | 1.6.4 |
| joomla | joomla_! | <= 1.6.6 | — |
| joomla | joomla_! | <= 1.6.3 | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
| joomla | joomla_! | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Joomla! vulnerable to Cross-site Scripting
ghsa·2022-05-14
CVE-2011-2509 [MEDIUM] CWE-79 Joomla! vulnerable to Cross-site Scripting
Joomla! vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component, as demonstrated by the filter_order parameter to index.php; (3) the query string to the com_newsfeeds component, as demonstrated by an arbitrary parameter to index.php; or (4) the option parameter in a reset.request action to index.php; and, when Internet Explorer or Konqueror is used, (5) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component.
OSV
Joomla! vulnerable to Cross-site Scripting
osv·2022-05-14
CVE-2011-2509 [MEDIUM] Joomla! vulnerable to Cross-site Scripting
Joomla! vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component, as demonstrated by the filter_order parameter to index.php; (3) the query string to the com_newsfeeds component, as demonstrated by an arbitrary parameter to index.php; or (4) the option parameter in a reset.request action to index.php; and, when Internet Explorer or Konqueror is used, (5) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component.
GHSA
GHSA-2p37-x8h9-2j2q: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1
ghsa_unreviewed·2022-05-14·CVSS 4.3
CVE-2011-2710 [MEDIUM] CWE-79 GHSA-2p37-x8h9-2j2q: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component. NOTE: vector 2 exists because of an incomplete fix for CVE-2011-2509.5.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://developer.joomla.org/security/news/352-20110604-xss-vulnerability.htmlhttp://www.openwall.com/lists/oss-security/2011/06/28/4http://www.openwall.com/lists/oss-security/2011/06/29/12http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.6.3%5D_cross_site_scripting%28XSS%29http://developer.joomla.org/security/news/352-20110604-xss-vulnerability.htmlhttp://www.openwall.com/lists/oss-security/2011/06/28/4http://www.openwall.com/lists/oss-security/2011/06/29/12http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.6.3%5D_cross_site_scripting%28XSS%29
2011-07-27
Published