CVE-2014-9103

Published: Nov 26, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) index value of an array parameter or the filename parameter in the Content-Disposition header to the (2) file or (3) profile image upload functionality.

Affected (1)

Products: Kunena: Kunena

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kunena Kunena	Up to 3.0.5

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

http://packetstormsecurity.com/files/127684/joomlakunena305-xss.txt

Source: cve@mitre.org

Exploit

http://www.kunena.org/blog/139-kunena-3-0-6-released

Source: cve@mitre.org

PatchVendor Advisory

http://www.kunena.org/docs/Kunena_3.0.6_Read_Me

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/68956

Source: cve@mitre.org

http://packetstormsecurity.com/files/127684/joomlakunena305-xss.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.kunena.org/blog/139-kunena-3-0-6-released

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.kunena.org/docs/Kunena_3.0.6_Read_Me

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/68956

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.