JO
CMS
Joomla
On CISA KEVExploited in the wild
424
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 38High 64Medium 152Low 3
Watch
Add Joomla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-1612 | – | Sep 6 | Cross-site scripting (XSS) vulnerability in the update manager in Joomla! 2.5.x before 2.5.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3 |
| CVE-2012-1611 | – | Sep 6 | Joomla! 2.5.x before 2.5.4 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end" information via unknown attack vectors Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3 |
| CVE-2012-0837 | – | Sep 6 | Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator." Affected: 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 2.5.0 |
| CVE-2012-0836 | – | Sep 6 | Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 allows attackers to read the error log via unknown vectors Affected: 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4 |
| CVE-2012-0835 | – | Sep 6 | Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain sensitive information via unknown vectors related to "administrator." Affected: 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 2.5.0 |
| CVE-2012-0822 | – | Sep 6 | Cross-site scripting (XSS) vulnerability in Joomla! 1.6 and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different… Affected: 1.6; 1.6; 1.6; 1.6; 1.6; 1.6; +22 more |
| CVE-2012-0821 | – | Sep 6 | Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than… Affected: 1.6; 1.6; 1.6; 1.6; 1.6; 1.6; +22 more |
| CVE-2012-0820 | – | Sep 6 | Cross-site scripting (XSS) vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a… Affected: 1.6; 1.6; 1.6; 1.6; 1.6; 1.6; +22 more |
| CVE-2012-0819 | – | Sep 6 | Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than… Affected: 1.6; 1.6; 1.6; 1.6; 1.6; 1.6; +22 more |
| CVE-2012-3829 | – | Jul 3 | Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header Affected: 2.5.3 |
| CVE-2012-3828 | – | Jul 3 | Cross-site scripting (XSS) vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header Affected: 2.5.3 |
| CVE-2012-2748 | – | Jul 3 | Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to obtain sensitive information via vectors related to "Inadequate filtering" and a "SQL error." Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4 |
| CVE-2012-2747 | – | Jul 3 | Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to gain privileges via unknown attack vectors related to "Inadequate checking." Affected: 2.5.0; 2.5.0; 2.5.0; 2.5.0; 2.5.1; 2.5.2; +2 more |
| CVE-2011-4332 | – | Nov 23 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 1.6.3; 1.6; 1.6; 1.6; 1.6; 1.6; +18 more |
| CVE-2011-4321 | – | Nov 23 | The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +20 more |
| CVE-2011-3747 | – | Sep 23 | Joomla! 1.6.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated… Affected: 1.6.0 |
| CVE-2011-2892 | – | Jul 27 | Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking… Affected: 1.6; 1.6; 1.6; 1.6; 1.6; 1.6; +14 more |
| CVE-2011-2891 | – | Jul 27 | Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an… Affected: 1.6; 1.6; 1.6; 1.6; 1.6; 1.6; +14 more |
| CVE-2011-2890 | – | Jul 27 | The MediaViewMedia class in administrator/components/com_media/views/media/view.html.php in Joomla! 1.5.23 and earlier allows remote attackers to obtain sensitive information via… Affected: through 1.5.23; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +19 more |
| CVE-2011-2889 | – | Jul 27 | templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a… Affected: through 1.5.22; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +18 more |
| CVE-2011-2710 | – | Jul 27 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to… Affected: through 1.6.6; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +34 more |
| CVE-2011-2509 | – | Jul 27 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the… Affected: through 1.6.3; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +34 more |
| CVE-2011-2488 | – | Jul 27 | Joomla! before 1.5.23 does not properly check for errors, which allows remote attackers to obtain sensitive information via unspecified vectors Affected: through 1.5.22; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +18 more |
| CVE-2010-4696 | – | Jan 18 | Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via the (1) filter_order or (2) filter_order_Dir… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +17 more |
| CVE-2010-4166 | – | Jan 18 | Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via (1) the filter_order parameter in a com_weblinks… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +17 more |
| CVE-2010-3712 | – | Oct 28 | Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +16 more |
| CVE-2010-2535 | – | Oct 5 | Multiple cross-site scripting (XSS) vulnerabilities in the Back End in Joomla! 1.5.x before 1.5.20 allow remote authenticated users to inject arbitrary web script or HTML via… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +15 more |
| CVE-2010-2679 | – | Jul 8 | SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to… Affected: All versions, or not specified |
| CVE-2010-1649 | – | Jun 8 | Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +12 more |
| CVE-2009-3946 | – | Nov 16 | Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request Affected: through 1.5.14; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +9 more |
| CVE-2009-3945 | – | Nov 16 | Unspecified vulnerability in the Front-End Editor in the com_content component in Joomla! before 1.5.15 allows remote authenticated users, with Author privileges, to replace the… Affected: through 1.5.14; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +9 more |
| CVE-2008-6852 | – | Jul 7 | SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to… Affected: All versions, or not specified |
| CVE-2009-1940 | – | Jun 5 | Cross-site scripting (XSS) vulnerability in the administrator panel in the com_users core component for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary… Affected: 1.5; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +5 more |
| CVE-2009-1939 | – | Jun 5 | Cross-site scripting (XSS) vulnerability in the JA_Purity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 1.5.0_beta; 1.5.0_beta1; 1.5.0_beta2; 1.5.0_rc1; 1.5.1; 1.5.2; +8 more |
| CVE-2009-1938 | – | Jun 5 | Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database… Affected: 1.5; 1.5; 1.5; 1.5; 1.5.0; 1.5.0; +12 more |
| CVE-2009-1499 | – | May 1 | SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the article parameter in index.php Affected: All versions, or not specified |
| CVE-2009-1280 | – | Apr 9 | Multiple cross-site request forgery (CSRF) vulnerabilities in the com_media component for Joomla! 1.5.x through 1.5.9 allow remote attackers to hijack the authentication of… Affected: 1.5; 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.1; +8 more |
| CVE-2009-1279 | – | Apr 9 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5 through 1.5.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1)… Affected: 1.5; 1.5.0; 1.5.0; 1.5.0; 1.5.0; 1.5.1; +8 more |
| CVE-2008-6299 | – | Feb 26 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML… Affected: through 1.5.7; 1.0; 1.0.0; 1.0.1; 1.0.2; 1.0.3; +29 more |
| CVE-2008-5671 | – | Dec 19 | PHP remote file inclusion vulnerability in index.php in Joomla! 1.0.11 through 1.0.14, when RG_EMULATION is enabled in configuration.php, allows remote attackers to execute… Affected: through 1.0.14; 1.0.11; 1.0.12; 1.0.13 |
| CVE-2008-4105 | – | Sep 18 | JRequest in Joomla! 1.5 before 1.5.7 does not sanitize variables that were set with JRequest::setVar, which allows remote attackers to conduct "variable injection" attacks and… Affected: 1.5; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +1 more |
| CVE-2008-4104 | – | Sep 18 | Multiple open redirect vulnerabilities in Joomla! 1.5 before 1.5.7 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a "passed in"… Affected: 1.5; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +1 more |
| CVE-2008-4102 | – | Sep 18 | Joomla! 1.5 before 1.5.7 initializes PHP's PRNG with a weak seed, which makes it easier for attackers to guess the pseudo-random values produced by PHP's mt_rand function, as… Affected: 1.5; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +1 more |
| CVE-2008-3228 | – | Jul 18 | Joomla! before 1.5.4 does not configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs, which has unknown impact and remote attack vectors Affected: through 1.5.3; 1.0; 1.0.0; 1.0.1; 1.0.2; 1.0.3; +18 more |
| CVE-2008-3225 | – | Jul 18 | Joomla! before 1.5.4 allows attackers to access administration functionality, which has unknown impact and attack vectors related to a missing "LDAP security fix." Affected: through 1.5.3; 1.0; 1.0.0; 1.0.1; 1.0.2; 1.0.3; +18 more |
| CVE-2008-3226 | – | Jul 18 | The file caching implementation in Joomla! before 1.5.4 allows attackers to access cached pages via unknown attack vectors Affected: through 1.5.3; 1.0; 1.0.0; 1.0.1; 1.0.2; 1.0.3; +18 more |
| CVE-2008-3227 | – | Jul 18 | Unspecified vulnerability in Joomla! before 1.5.4 has unknown impact and attack vectors related to a "User Redirect Spam fix," possibly an open redirect vulnerability Affected: through 1.5.3; 1.0; 1.0.0; 1.0.1; 1.0.2; 1.0.3; +18 more |
| CVE-2008-2990 | – | Jul 2 | PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 for Mambo and Joomla! allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2008-2676 | – | Jun 12 | SQL injection vulnerability in the iJoomla News Portal (com_news_portal) component 1.0 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the… Affected: All versions, or not specified |
| CVE-2008-2633 | – | Jun 10 | Multiple SQL injection vulnerabilities in the EXP JoomRadio (com_joomradio) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the id parameter… Affected: All versions, or not specified |