← Back

Joomla

joomla

Vendor: Joomla • 405 CVEs

CVEs (405)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2006-4473
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
Unspecified vulnerability in com_content in Joomla! before 1.0.11, when $mosConfig_hideEmail is set, allows attackers to perform the emailform and emailsend tasks.
CVE-2006-4472
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple unspecified vulnerabilities in Joomla! before 1.0.11 allow attackers to bypass user authentication via unknown vectors involving the (1) do_pdf command and the (2) emailform com_content task.
CVE-2006-4471
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stories/ directory via unspecified vectors.
CVE-2006-4470
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Joomla! before 1.0.11 omits some checks for whether _VALID_MOS is defined, which allows attackers to have an unknown impact, possibly resulting in PHP remote file inclusion.
CVE-2006-4469
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Unspecified vulnerability in PEAR.php in Joomla! before 1.0.11 allows remote attackers to perform "remote execution," related to "Injection Flaws."
CVE-2006-4468
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the (1) mosMail, (2) JosIsValidEmail, and (3) josSp...Show more
Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the (1) mosMail, (2) JosIsValidEmail, and (3) josSpoofValue functions; (4) the lack of inclusion of globals.php in administrator/index.php; (5) the Admin User Manager; and (6) the poll module.Show less
CVE-2006-4466
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to have an unspecified...Show more
Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to have an unspecified impact. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Joomla!.Show less
CVE-2006-3481
1Joomla
1Joomla
Apr 16, 2026
Jul 10, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Joomla! before 1.0.10 allow remote attackers to execute arbitrary SQL commands via unspecified parameters involving the (1) "Remember Me" function, (2) "Related Items" module, an...Show more
Multiple SQL injection vulnerabilities in Joomla! before 1.0.10 allow remote attackers to execute arbitrary SQL commands via unspecified parameters involving the (1) "Remember Me" function, (2) "Related Items" module, and the (3) "Weblinks submission".Show less
CVE-2006-3480
1Joomla
1Joomla
Apr 16, 2026
Jul 10, 2006
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.10 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters involving the (1) getUserStateFromRequest function, an...Show more
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.10 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters involving the (1) getUserStateFromRequest function, and the (2) SEF and (3) com_messages modules.Show less
CVE-2006-2960
1Joomla
1Joomla
Apr 16, 2026
Jun 12, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
PHP remote file inclusion vulnerability in includes/joomla.php in Joomla! 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter.
CVE-2006-1957
2Joomla
Mambo Foundation
2Joomla
Mambo
Apr 16, 2026
Apr 21, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed par...Show more
The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed parameter.Show less
CVE-2006-1956
2Joomla
Mambo
2Joomla
Mambo
Apr 16, 2026
Apr 21, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message.
CVE-2006-1049
1Joomla
1Joomla
Apr 16, 2026
Mar 7, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in the Admin functionality in Joomla! 1.0.7 and earlier allow remote authenticated administrators to execute arbitrary SQL commands via unknown attack vectors.
CVE-2006-1048
1Joomla
1Joomla
Apr 16, 2026
Mar 7, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3) Newsfeeds, (4) Weblinks, (5) Content, (6...Show more
Joomla! 1.0.7 and earlier allows attackers to bypass intended access restrictions and gain certain privileges via certain attack vectors related to the (1) Weblink, (2) Polls, (3) Newsfeeds, (4) Weblinks, (5) Content, (6) Content Section, (7) Content Category, (8) Contact items, or (9) Contact Search, (10) Content Search, (11) Newsfeed Search, or (12) Weblink Search.Show less
CVE-2006-1047
1Joomla
1Joomla
Apr 16, 2026
Mar 7, 2006
N/A· v4
N/A· v3
10.0 HIGH· v2
Unspecified vulnerability in the "Remember Me login functionality" in Joomla! 1.0.7 and earlier has unknown impact and attack vectors.
CVE-2006-1030
1Joomla
1Joomla
Apr 16, 2026
Mar 7, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Unspecified vulnerability in mod_templatechooser in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via an unspecified attack vector that reveals the path.
CVE-2006-1029
1Joomla
1Joomla
Apr 16, 2026
Mar 7, 2006
N/A· v4
N/A· v3
4.3 MEDIUM· v2
The cross-site scripting (XSS) countermeasures in class.inputfilter.php in Joomla! 1.0.7 allow remote attackers to cause a denial of service via a crafted mosmsg parameter to index.php with a malformed sequence of multip...Show more
The cross-site scripting (XSS) countermeasures in class.inputfilter.php in Joomla! 1.0.7 allow remote attackers to cause a denial of service via a crafted mosmsg parameter to index.php with a malformed sequence of multiple tags, as demonstrated using "<<>AAA<><>", possibly due to nested or empty tags.Show less
CVE-2006-1028
1Joomla
1Joomla
Apr 16, 2026
Mar 7, 2006
N/A· v4
N/A· v3
7.8 HIGH· v2
feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php.
CVE-2006-1027
1Joomla
1Joomla
Apr 16, 2026
Mar 7, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a "/" (slash) in the feed parameter to index.php, which reveals the path in an error mess...Show more
feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to obtain sensitive information via a "/" (slash) in the feed parameter to index.php, which reveals the path in an error message.Show less
CVE-2006-0303
1Joomla
1Joomla
Apr 16, 2026
Jan 19, 2006
N/A· v4
N/A· v3
10.0 HIGH· v2
Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other components in Joomla! 1.0.5 and earlier have unknown impact and attack vectors.