JO
CMS
Joomla
On CISA KEVExploited in the wild
422
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 38High 63Medium 151Low 3
Watch
Add Joomla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-2564 | – | Jun 6 | SQL injection vulnerability in the JotLoader (com_jotloader) component 1.2.1.a and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid… Affected: All versions, or not specified |
| CVE-2008-1935 | – | Apr 25 | SQL injection vulnerability in the Filiale 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the idFiliale parameter Affected: 1.0.4 |
| CVE-2008-1533 | – | Mar 28 | Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors Affected: through 1.5 |
| CVE-2008-0829 | – | Feb 19 | SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands… Affected: All versions, or not specified |
| CVE-2008-0795 | – | Feb 15 | SQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid… Affected: 1.0 |
| CVE-2008-0561 | – | Feb 4 | SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL… Affected: All versions, or not specified |
| CVE-2008-0517 | – | Jan 31 | SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-2007-6643 | – | Jan 4 | Cross-site scripting (XSS) vulnerability in the com_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 1.5rc4 |
| CVE-2007-6642 | – | Jan 4 | Multiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary… Affected: 1.5rc4 |
| CVE-2007-6645 | – | Jan 4 | Unspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation… Affected: 1.5rc4 |
| CVE-2007-6644 | – | Jan 4 | Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the intended security model Affected: 1.5rc4 |
| CVE-2007-6272 | – | Dec 7 | Multiple SQL injection vulnerabilities in index.php in Joomla! 1.5 RC3 allow remote attackers to execute arbitrary SQL commands via (1) the view parameter to the com_content… Affected: 1.5rc3 |
| CVE-2007-5577 | – | Oct 18 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.13 (aka Sunglow) allow remote attackers to inject arbitrary web script or HTML via the (1) Title or (2)… Affected: before 1.0.13 |
| CVE-2007-5457 | – | Oct 14 | Multiple PHP remote file inclusion vulnerabilities in Michael Dempfle Joomla Flash Uploader (com_jfu or com_joomla_flash_uploader) 2.5.1 component for Joomla! allow remote… Affected: All versions, or not specified |
| CVE-2007-5451 | – | Oct 14 | PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via… Affected: All versions, or not specified |
| CVE-2007-5427 | – | Oct 12 | Cross-site scripting (XSS) vulnerability in the com_search component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the… Affected: through 1.0.13 |
| CVE-2007-5410 | – | Oct 12 | PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader (com_wmtrssreader) 1.0 component for Joomla! allows remote attackers… Affected: All versions, or not specified |
| CVE-2007-5389 | – | Oct 12 | PHP remote file inclusion vulnerability in preview.php in the swMenuFree (com_swmenufree) 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL… Affected: All versions, or not specified |
| CVE-2007-5362 | – | Oct 11 | Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite (com_mosmedia) 4.5.1 component for Mambo and Joomla! allow remote attackers to… Affected: All versions, or not specified |
| CVE-2007-5363 | – | Oct 11 | PHP remote file inclusion vulnerability in admin.panoramic.php in the Panoramic Picture Viewer (com_panoramic) mambot (plugin) 1.0 for Joomla! allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2007-5310 | – | Oct 9 | PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtportfolio) component for Joomla! allows remote attackers to… Affected: All versions, or not specified |
| CVE-2007-5309 | – | Oct 9 | PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com_wmtgallery) 1.0 component for Joomla! allows remote attackers to… Affected: All versions, or not specified |
| CVE-2007-5065 | – | Sep 24 | PHP remote file inclusion vulnerability in admin.slideshow1.php in the Flash Slide Show (com_slideshow) component for Joomla! allows remote attackers to execute arbitrary PHP code… Affected: All versions, or not specified |
| CVE-2007-4779 | – | Sep 10 | Cross-site scripting (XSS) vulnerability in Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably… Affected: 1.5.0_beta; 1.5.0_beta2; 1.5.0_rc1 |
| CVE-2007-4778 | – | Sep 10 | Multiple SQL injection vulnerabilities in the content component (com_content) in Joomla! 1.5 Beta1, Beta2, and RC1 allow remote attackers to execute arbitrary SQL commands via the… Affected: 1.5.0_beta1; 1.5.0_beta2; 1.5.0_rc1 |
| CVE-2007-4777 | – | Sep 10 | SQL injection vulnerability in Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to the… Affected: 1.5.0_beta; 1.5.0_beta2; 1.5.0_rc1 |
| CVE-2007-4780 | – | Sep 10 | Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to obtain sensitive information (the full path) via unspecified vectors, probably involving direct requests to certain… Affected: 1.5.0_beta; 1.5.0_beta2; 1.5.0_rc1 |
| CVE-2007-4781 | – | Sep 10 | administrator/index.php in the installer component (com_installer) in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote authenticated administrators to upload arbitrary files to… Affected: 1.5.0_beta1; 1.5.0_beta2; 1.5.0_rc1 |
| CVE-2007-4184 | – | Aug 8 | SQL injection vulnerability in administrator/popups/pollwindow.php in Joomla! 1.0.12 allows remote attackers to execute arbitrary SQL commands via the pollid parameter Affected: 1.0.12 |
| CVE-2007-4190 | – | Aug 8 | CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks… Affected: before 1.0.13 |
| CVE-2007-4189 | – | Aug 8 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.13 (aka Sunglow) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in… Affected: before 1.0.13 |
| CVE-2007-4188 | – | Aug 8 | Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to hijack administrative web sessions via unspecified vectors Affected: before 1.0.13 |
| CVE-2007-4187 | – | Aug 8 | Multiple eval injection vulnerabilities in the com_search component in Joomla! 1.5 beta before RC1 (aka Mapya) allow remote attackers to execute arbitrary PHP code via PHP… Affected: 1.5.0_beta |
| CVE-2007-4185 | – | Aug 8 | Joomla! 1.0.12 allows remote attackers to obtain sensitive information via a direct request for (1) Stat.php (2) OutputFilter.php, (3) OutputCache.php, (4) Modifier.php, (5)… Affected: 1.0.12 |
| CVE-2007-2199 | – | Apr 24 | PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Library, as used in multiple… Affected: 1.5.0 |
| CVE-2006-7008 | – | Feb 12 | Unspecified vulnerability in Joomla! before 1.0.10 has unknown impact and attack vectors, related to "securing mosmsg from misuse." NOTE: it is possible that this issue overlaps… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +4 more |
| CVE-2006-7009 | – | Feb 12 | Joomla! before 1.0.10 allows remote attackers to spoof the frontend submission forms, which has unknown impact and attack vectors Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +4 more |
| CVE-2006-7010 | – | Feb 12 | The mosgetparam implementation in Joomla! before 1.0.10, does not set a variable's data type to integer when the variable's default value is numeric, which has unspecified impact… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +4 more |
| CVE-2007-0374 | – | Jan 19 | SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling… Affected: 1.0.11; 1.5.0_beta |
| CVE-2007-0373 | – | Jan 19 | Multiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via (1) the searchword parameter in certain files; the where… Affected: 1.5.0_beta |
| CVE-2007-0387 | – | Jan 19 | SQL injection vulnerability in models/category.php in the Weblinks component for Joomla! SVN 20070118 (com_weblinks) allows remote attackers to execute arbitrary SQL commands via… Affected: 2007-01-18 |
| CVE-2007-0375 | – | Jan 19 | Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for (1) plugins/user/example.php; (2) gmail.php, (3) example.php, or (4) ldap.php… Affected: 1.5.0_beta |
| CVE-2006-6832 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in Joomla! before 1.0.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +5 more |
| CVE-2006-6834 | – | Dec 31 | Multiple unspecified vulnerabilities in Joomla! before 1.0.12 have unknown impact and attack vectors related to (1) "unneeded legacy functions" and (2) "Several low level security… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +5 more |
| CVE-2006-6833 | – | Dec 31 | com_categories in Joomla! before 1.0.12 does not validate input, which has unknown impact and remote attack vectors Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +5 more |
| CVE-2006-4474 | – | Aug 31 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.11 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) Admin… Affected: through 1.0.10; 1.0.9 |
| CVE-2006-4473 | – | Aug 31 | Unspecified vulnerability in com_content in Joomla! before 1.0.11, when $mosConfig_hideEmail is set, allows attackers to perform the emailform and emailsend tasks Affected: through 1.0.10; 1.0.9 |
| CVE-2006-4472 | – | Aug 31 | Multiple unspecified vulnerabilities in Joomla! before 1.0.11 allow attackers to bypass user authentication via unknown vectors involving the (1) do_pdf command and the (2)… Affected: before 1.0.11 |
| CVE-2006-4471 | – | Aug 31 | The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stories/ directory via unspecified vectors Affected: before 1.0.11 |
| CVE-2006-4470 | – | Aug 31 | Joomla! before 1.0.11 omits some checks for whether _VALID_MOS is defined, which allows attackers to have an unknown impact, possibly resulting in PHP remote file inclusion Affected: before 1.0.11 |