JO
CMS
Joomla
On CISA KEVExploited in the wild
420
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 38High 63Medium 149Low 3
Watch
Add Joomla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2006-4474 | – | Aug 31 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.11 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) Admin… Affected: through 1.0.10; 1.0.9 |
| CVE-2006-4475 | – | Aug 31 | Joomla! before 1.0.11 does not limit access to the Admin Popups functionality, which has unknown impact and attack vectors Affected: through 1.0.10; 1.0.9 |
| CVE-2006-4476 | – | Aug 31 | Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via (1) globals.php, which uses… Affected: through 1.0.10; 1.0.9 |
| CVE-2006-3480 | – | Jul 10 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.10 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters involving the… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +3 more |
| CVE-2006-3481 | – | Jul 10 | Multiple SQL injection vulnerabilities in Joomla! before 1.0.10 allow remote attackers to execute arbitrary SQL commands via unspecified parameters involving the (1) "Remember Me"… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +3 more |
| CVE-2006-2960 | – | Jun 12 | PHP remote file inclusion vulnerability in includes/joomla.php in Joomla! 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter Affected: 1.0 |
| CVE-2006-1956 | – | Apr 21 | The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error… Affected: 1.0.7 |
| CVE-2006-1957 | – | Apr 21 | The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple… Affected: All versions, or not specified |
| CVE-2006-1048 | – | Mar 7 | Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3)… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +2 more |
| CVE-2006-1047 | – | Mar 7 | Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier has unknown impact and attack vectors Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +2 more |
| CVE-2006-1049 | – | Mar 7 | Multiple SQL injection vulnerabilities in the Admin functionality in Joomla! 1.0.7 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via… Affected: through 1.0.7; 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +2 more |
| CVE-2006-1028 | – | Mar 7 | feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to cause a denial of service (stressed file cache) by creating many files via… Affected: 1.0.7 |
| CVE-2006-1030 | – | Mar 7 | Unspecified vulnerability in mod_templatechooser in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via an unspecified attack vector that reveals the path Affected: 1.0.7 |
| CVE-2006-1027 | – | Mar 7 | feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a "/" (slash) in the feed parameter to… Affected: 1.0.7 |
| CVE-2006-1029 | – | Mar 7 | The cross-site scripting (XSS) countermeasures in class.inputfilter.php in Joomla! 1.0.7 allow remote attackers to cause a denial of service via a crafted mosmsg parameter to… Affected: 1.0.7 |
| CVE-2006-0303 | – | Jan 19 | Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other components in Joomla! 1.0.5 and earlier have… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5 |
| CVE-2006-0114 | – | Jan 9 | The vCard functions in Joomla! 1.0.5 use predictable sequential IDs for vcards and do not restrict access to them, which allows remote attackers to obtain valid e-mail addresses… Affected: 1.0.5 |
| CVE-2005-3773 | – | Nov 23 | Unspecified vulnerability in Joomla! before 1.0.4 has unknown impact and attack vectors, related to "Potential misuse of Media component file management functions." Affected: 1.0; 1.0.1; 1.0.2; 1.0.3 |
| CVE-2005-3771 | – | Nov 23 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) "GET and other variables" and (2)… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3 |
| CVE-2005-3772 | – | Nov 23 | Multiple SQL injection vulnerabilities in Joomla! before 1.0.4 allow remote attackers to execute arbitrary SQL commands via the (1) Itemid variable in the Polls modules and (2)… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3 |