Unscored severity · published Mar 7, 2006
CVE-2006-1048
Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3)…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3) Newsfeeds, (4) Weblinks, (5) Content, (6) Content Section, (7) Content Category, (8) Contact items, or (9) Contact Search, (10) Content Search, (11) Newsfeed Search, or (12) Weblink Search.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JO
Joomla · Joomla
1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1048
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1048
Patch
http://secunia.com/advisories/19105
Patch
http://www.joomla.org/content/view/938/78/
www.osvdb.org
http://www.osvdb.org/23822
www.vupen.com
http://www.vupen.com/english/advisories/2006/0818
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/25033
More from Joomla
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
5.3
CVE-2023-23752
[20230201] - Core - Improper access check in webservice endpoints
9.8
CVE-2026-73373
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
9.8
CVE-2026-35221
Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
9.8
CVE-2026-40383
Joomla! Core - [20260509] - LFI in HTMLView layout parameter