← Back

Joomla

joomla

Vendor: Joomla • 405 CVEs

CVEs (405)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-4105
1Joomla
1Joomla
Apr 23, 2026
Sep 18, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
JRequest in Joomla! 1.5 before 1.5.7 does not sanitize variables that were set with JRequest::setVar, which allows remote attackers to conduct "variable injection" attacks and have unspecified other impact.
CVE-2008-4104
1Joomla
1Joomla
Apr 23, 2026
Sep 18, 2008
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Multiple open redirect vulnerabilities in Joomla! 1.5 before 1.5.7 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a "passed in" URL.
CVE-2008-4102
1Joomla
1Joomla
Apr 23, 2026
Sep 18, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Joomla! 1.5 before 1.5.7 initializes PHP's PRNG with a weak seed, which makes it easier for attackers to guess the pseudo-random values produced by PHP's mt_rand function, as demonstrated by guessing password reset token...Show more
Joomla! 1.5 before 1.5.7 initializes PHP's PRNG with a weak seed, which makes it easier for attackers to guess the pseudo-random values produced by PHP's mt_rand function, as demonstrated by guessing password reset tokens, a different vulnerability than CVE-2008-3681.Show less
CVE-2008-3228
1Joomla
1Joomla
Apr 23, 2026
Jul 18, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Joomla! before 1.5.4 does not configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs, which has unknown impact and remote attack vectors.
CVE-2008-3227
1Joomla
1Joomla
Apr 23, 2026
Jul 18, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Unspecified vulnerability in Joomla! before 1.5.4 has unknown impact and attack vectors related to a "User Redirect Spam fix," possibly an open redirect vulnerability.
CVE-2008-3226
1Joomla
1Joomla
Apr 23, 2026
Jul 18, 2008
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The file caching implementation in Joomla! before 1.5.4 allows attackers to access cached pages via unknown attack vectors.
CVE-2008-3225
1Joomla
1Joomla
Apr 23, 2026
Jul 18, 2008
N/A· v4
N/A· v3
10.0 HIGH· v2
Joomla! before 1.5.4 allows attackers to access administration functionality, which has unknown impact and attack vectors related to a missing "LDAP security fix."
CVE-2008-2990
2Joomla
Mambo
3Com Facileforms
Com FacileformsJoomla
Apr 23, 2026
Jul 2, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the ff_compat...Show more
PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the ff_compath parameter.Show less
CVE-2008-2676
1Joomla
2Com News Portal
Joomla
Apr 23, 2026
Jun 12, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the iJoomla News Portal (com_news_portal) component 1.0 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
CVE-2008-2633
1Joomla
2Com Joomradio
Joomla
Apr 23, 2026
Jun 10, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in the EXP JoomRadio (com_joomradio) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) show_radio or (2) show_video ac...Show more
Multiple SQL injection vulnerabilities in the EXP JoomRadio (com_joomradio) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) show_radio or (2) show_video action to index.php.Show less
CVE-2008-2632
1Joomla
2Com Acctexp
Joomla
Apr 23, 2026
Jun 10, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the acctexp (com_acctexp) component 0.12.x and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the usage parameter in a subscribe action to index.php.
CVE-2008-2568
1Joomla
2Com Simpleshop
Joomla
Apr 23, 2026
Jun 6, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a browse action to index.p...Show more
SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a browse action to index.php.Show less
CVE-2008-2564
1Joomla
2Com Jotloader
Joomla
Apr 23, 2026
Jun 6, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the JotLoader (com_jotloader) component 1.2.1.a and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter to index.php.
CVE-2008-1935
1Joomla
1Joomla
Apr 23, 2026
Apr 25, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the Filiale 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the idFiliale parameter.
CVE-2008-1533
1Joomla
1Joomla
Apr 23, 2026
Mar 28, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors.
CVE-2008-0829
3Joomla
JoomlapixelMambo
3Jooget
JoomlaMambo
Apr 23, 2026
Feb 19, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail task.
CVE-2008-0795
3Joomla
MamboMgfi
3Joomla
MamboXfaq
Apr 23, 2026
Feb 15, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an answer action.
CVE-2008-0561
3Arthur Konze Webdesign
JoomlaMambo
3Akogallery
JoomlaMambo
Apr 23, 2026
Feb 4, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail...Show more
SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (com_akogallery) 2.5 beta component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.Show less
CVE-2008-0517
3Darko Selesi
JoomlaMambo
3Estateagent
JoomlaMambo
Apr 23, 2026
Jan 31, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote attackers to execute arbitrary SQL commands via the objid parameter in a...Show more
SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote attackers to execute arbitrary SQL commands via the objid parameter in a contact showObject action.Show less
CVE-2007-6645
1Joomla
1Joomla
Apr 23, 2026
Jan 4, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Unspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "registered user privilege escalation vulnerability."