CVEs (421)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file...Show more |
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead...Show more |
Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items. |
Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks. |
Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints. |
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endp...Show more |
An improper access check allows unauthorized users to create custom fields via webservices endpoints. |
An improper access check allows unauthorized users to access com_privacy datasets. |
An improper access check allows users to display a list of modules in the frontend. |
An improper access check allows unauthorized users to access workflow stage and transition information. |
Improper validation leads to a generic XSS vector in the language override feature. |
Lack of escaping leads to an XSS vulnerability in the generic image output layout. |
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. |
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. |
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. |
Lack of validation leads to an XSS vulnerability in the MFA management views. |
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. |
An improper access check allows privileged users to overwrite media files without editing permissions. |
Lack of input filtering leads to an XSS vector in the HTML filter code. |
An improper access check allows privelege escalation through the com_users group editing webservice endpoint. |