Joomla ! vulnerabilities

276 known vulnerabilities affecting joomla/joomla_!.

Total CVEs
276
CISA KEV
2
actively exploited
Public exploits
22
Exploited in wild
6
Severity breakdown
CRITICAL30HIGH68MEDIUM176LOW2

Vulnerabilities

Page 11 of 14
CVE-2015-7859MEDIUMCVSS 5.0v3.2.0v3.2.1+13 more2015-10-29
CVE-2015-7859 [MEDIUM] CWE-200 CVE-2015-7859: The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which all The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
nvd
CVE-2015-7899MEDIUMCVSS 5.0v3.2.0v3.2.1+13 more2015-10-29
CVE-2015-7899 [MEDIUM] CWE-284 CVE-2015-7899: The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows rem The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
nvd
CVE-2015-6939MEDIUMCVSS 4.3v3.4.0v3.4.1+2 more2015-09-18
CVE-2015-6939 [MEDIUM] CWE-79 CVE-2015-6939: Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows re Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2015-5397MEDIUMCVSS 6.8v3.2.0v3.2.1+13 more2015-07-14
CVE-2015-5397 [MEDIUM] CWE-352 CVE-2015-5397: Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4. Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload code via unknown vectors.
nvd
CVE-2014-7228HIGHCVSS 7.5PoCv2.5.4v2.5.5+43 more2014-11-03
CVE-2014-7228 [HIGH] CWE-310 CVE-2014-7228: Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when p
nvd
CVE-2012-2413MEDIUMCVSS 4.3≤ 1.5.26v1.5.0+25 more2014-10-20
CVE-2012-2413 [MEDIUM] CWE-79 CVE-2012-2413: Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier al Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.
nvd
CVE-2014-7981HIGHCVSS 7.5v3.1.0v3.1.1+8 more2014-10-08
CVE-2014-7981 [HIGH] CWE-89 CVE-2014-7981: SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to e SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
nvd
CVE-2014-7984HIGHCVSS 7.5v2.5.0v2.5.1+32 more2014-10-08
CVE-2014-7984 [HIGH] CWE-264 CVE-2014-7984: Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and byp Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.
nvd
CVE-2014-6632HIGHCVSS 7.5v2.5.0v2.5.1+30 more2014-10-08
CVE-2014-6632 [HIGH] CWE-287 CVE-2014-6632: Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to aut Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.
nvd
CVE-2014-7982MEDIUMCVSS 4.3v2.5.0v2.5.1+32 more2014-10-08
CVE-2014-7982 [MEDIUM] CWE-79 CVE-2014-7982: Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 all Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2014-7983MEDIUMCVSS 4.3v3.1.2v3.1.3+6 more2014-10-08
CVE-2014-7983 [MEDIUM] CWE-79 CVE-2014-7983: Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3. Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2014-7229MEDIUMCVSS 5.0v2.5.4v2.5.5+29 more2014-10-08
CVE-2014-7229 [MEDIUM] CVE-2014-7229: Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial of service via unspecified vectors.
nvd
CVE-2014-6631MEDIUMCVSS 4.3v3.2.0v3.2.1+7 more2014-10-08
CVE-2014-6631 [MEDIUM] CWE-79 CVE-2014-6631: Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2013-5583MEDIUMCVSS 4.3v3.1.52013-12-29
CVE-2013-5583 [MEDIUM] CWE-79 CVE-2013-5583: Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allo Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
nvd
CVE-2013-5576MEDIUMCVSS 6.8ExploitedPoCv2.5.0v2.5.1+22 more2013-10-09
CVE-2013-5576 [MEDIUM] CWE-20 CVE-2013-5576: administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2. administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended access restrictions and upload files with dangerous extensions via a filename with a trailing . (dot), as exploited in the wild in August 2013.
nvd
CVE-2013-3059MEDIUMCVSS 4.3v2.5.0v2.5.1+12 more2013-05-03
CVE-2013-3059 [MEDIUM] CWE-79 CVE-2013-3059: Cross-site scripting (XSS) vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0 Cross-site scripting (XSS) vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2013-3242MEDIUMCVSS 5.5PoCv3.0.0v3.0.1+12 more2013-05-03
CVE-2013-3242 [MEDIUM] CWE-20 CVE-2013-3242: plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors.
nvd
CVE-2013-3056MEDIUMCVSS 4.0v2.5.0v2.5.1+12 more2013-05-03
CVE-2013-3056 [MEDIUM] CWE-264 CVE-2013-3056: Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass inten Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors.
nvd
CVE-2013-3058MEDIUMCVSS 4.3v2.5.0v2.5.1+12 more2013-05-03
CVE-2013-3058 [MEDIUM] CWE-79 CVE-2013-3058: Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allow Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2013-3057MEDIUMCVSS 4.0v2.5.0v2.5.1+12 more2013-05-03
CVE-2013-3057 [MEDIUM] CWE-264 CVE-2013-3057: Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass inten Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors.
nvd
← Previous11 / 14Next →