Joomla ! vulnerabilities

CVE-2014-6631 [MEDIUM] CWE-79 CVE-2014-6631: Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2017-14595 [LOW] CVE-2017-14595: In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro te In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state.

CVE-2011-2889 [MEDIUM] CVE-2011-2889: templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path. NOTE: this might overlap CVE-2011-2488.

CVE-2011-2710 [MEDIUM] CVE-2011-2710: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers t Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a

CVE-2011-2509 [MEDIUM] CWE-79 CVE-2011-2509: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers t Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component, as demonstrated by the filter_order parameter to index.p

CVE-2011-4332 [MEDIUM] CWE-79 CVE-2011-4332: Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attack Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2024-21723 [MEDIUM] CWE-601 CVE-2024-21723: Inadequate parsing of URLs could result into an open redirect. Inadequate parsing of URLs could result into an open redirect.

CVE-2007-4190 [MEDIUM] CWE-74 CVE-2007-4190: CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to injec CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter. NOTE: this can be leveraged for cross-site scripting (XSS) attacks. NOTE: some of these details are obtained from third party informati

CVE-2010-1649 [MEDIUM] CWE-79 CVE-2010-1649: Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 al Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in administrator/index.php.

CVE-2011-2892 [MEDIUM] CWE-20 CVE-2011-2892: Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML docu Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2011-2891 [MEDIUM] CVE-2011-2891: Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Item Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488.

CVE-2011-3747 [MEDIUM] CWE-200 CVE-2011-3747: Joomla! 1.6.0 allows remote attackers to obtain sensitive information via a direct request to a .php Joomla! 1.6.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by libraries/phpmailer/language/phpmailer.lang-joomla.php.

CVE-2026-90916 [LOW] CWE-284 CVE-2026-90916: Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents.

CVE-2010-2535 [LOW] CWE-79 CVE-2010-2535: Multiple cross-site scripting (XSS) vulnerabilities in the Back End in Joomla! 1.5.x before 1.5.20 a Multiple cross-site scripting (XSS) vulnerabilities in the Back End in Joomla! 1.5.x before 1.5.20 allow remote authenticated users to inject arbitrary web script or HTML via administrator screens.