← Back

Joomla

joomla

Vendor: Joomla • 421 CVEs

CVEs (421)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-4185
1Joomla
1Joomla
Apr 23, 2026
Aug 8, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Joomla! 1.0.12 allows remote attackers to obtain sensitive information via a direct request for (1) Stat.php (2) OutputFilter.php, (3) OutputCache.php, (4) Modifier.php, (5) Reader.php, and (6) TemplateCache.php in inclu...Show more
Joomla! 1.0.12 allows remote attackers to obtain sensitive information via a direct request for (1) Stat.php (2) OutputFilter.php, (3) OutputCache.php, (4) Modifier.php, (5) Reader.php, and (6) TemplateCache.php in includes/patTemplate/patTemplate/; (7) includes/Cache/Lite/Output.php; and other unspecified components, which reveal the path in various error messages.Show less
CVE-2007-4184
1Joomla
1Joomla
Apr 23, 2026
Aug 8, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in administrator/popups/pollwindow.php in Joomla! 1.0.12 allows remote attackers to execute arbitrary SQL commands via the pollid parameter.
CVE-2007-2199
4Cjg Explorer Pro
JoomlaNx+1 more
4Cjg Explorer Pro
JoomlaN X Wcms+1 more
Apr 23, 2026
Apr 24, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Library, as used in multiple products including (1) Joomla! 1.5.0 Beta, (2)...Show more
PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Library, as used in multiple products including (1) Joomla! 1.5.0 Beta, (2) N/X Web Content Management System (WCMS) 4.5, (3) CJG EXPLORER PRO 3.3, and (4) phpSiteBackup 0.1, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.Show less
CVE-2006-7010
1Joomla
1Joomla
Apr 23, 2026
Feb 12, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
The mosgetparam implementation in Joomla! before 1.0.10, does not set a variable's data type to integer when the variable's default value is numeric, which has unspecified impact and attack vectors, which may permit SQL...Show more
The mosgetparam implementation in Joomla! before 1.0.10, does not set a variable's data type to integer when the variable's default value is numeric, which has unspecified impact and attack vectors, which may permit SQL injection attacks.Show less
CVE-2006-7009
1Joomla
1Joomla
Apr 23, 2026
Feb 12, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Joomla! before 1.0.10 allows remote attackers to spoof the frontend submission forms, which has unknown impact and attack vectors.
CVE-2006-7008
1Joomla
1Joomla
Apr 23, 2026
Feb 12, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Unspecified vulnerability in Joomla! before 1.0.10 has unknown impact and attack vectors, related to "securing mosmsg from misuse." NOTE: it is possible that this issue overlaps CVE-2006-1029.
CVE-2007-0387
1Joomla
1Joomla
Apr 23, 2026
Jan 19, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in models/category.php in the Weblinks component for Joomla! SVN 20070118 (com_weblinks) allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVE-2007-0375
1Joomla
1Joomla
Apr 23, 2026
Jan 19, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for (1) plugins/user/example.php; (2) gmail.php, (3) example.php, or (4) ldap.php in plugins/authentication/; (5) modules/mo...Show more
Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for (1) plugins/user/example.php; (2) gmail.php, (3) example.php, or (4) ldap.php in plugins/authentication/; (5) modules/mod_mainmenu/menu.php; or other unspecified PHP scripts, which reveals the path in various error messages, related to a jimport function call at the beginning of each script.Show less
CVE-2007-0374
2Joomla
Mambo
2Joomla
Mambo
Apr 23, 2026
Jan 19, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing.
CVE-2007-0373
1Joomla
1Joomla
Apr 23, 2026
Jan 19, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Multiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via (1) the searchword parameter in certain files; the where parameter in (2) plugins/search/content.p...Show more
Multiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via (1) the searchword parameter in certain files; the where parameter in (2) plugins/search/content.php or (3) plugins/search/weblinks.php; the text parameter in (4) plugins/search/contacts.php, (5) plugins/search/categories.php, or (6) plugins/search/sections.php; or (7) the email parameter in database/table/user.php, which is not properly handled by the check function.Show less
CVE-2006-6834
1Joomla
1Joomla
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Multiple unspecified vulnerabilities in Joomla! before 1.0.12 have unknown impact and attack vectors related to (1) "unneeded legacy functions" and (2) "Several low level security fixes."
CVE-2006-6833
1Joomla
1Joomla
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
com_categories in Joomla! before 1.0.12 does not validate input, which has unknown impact and remote attack vectors.
CVE-2006-6832
1Joomla
1Joomla
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Joomla! before 1.0.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to poll.php or the module title.
CVE-2006-4476
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via (1) globals.php, which uses include_once() instead of require(); (2) the $options...Show more
Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via (1) globals.php, which uses include_once() instead of require(); (2) the $options variable; (3) Admin Upload Image; (4) ->load(); (5) content submissions when frontpage is selected; (6) the mosPageNav constructor; (7) saveOrder functions; (8) the absence of "exploit blocking rules" in htaccess; and (9) the ACL.Show less
CVE-2006-4475
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Joomla! before 1.0.11 does not limit access to the Admin Popups functionality, which has unknown impact and attack vectors.
CVE-2006-4474
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.11 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) Admin Module Manager, (2) Admin Help, and (3) S...Show more
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.11 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) Admin Module Manager, (2) Admin Help, and (3) Search.Show less
CVE-2006-4473
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
Unspecified vulnerability in com_content in Joomla! before 1.0.11, when $mosConfig_hideEmail is set, allows attackers to perform the emailform and emailsend tasks.
CVE-2006-4472
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple unspecified vulnerabilities in Joomla! before 1.0.11 allow attackers to bypass user authentication via unknown vectors involving the (1) do_pdf command and the (2) emailform com_content task.
CVE-2006-4471
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stories/ directory via unspecified vectors.
CVE-2006-4470
1Joomla
1Joomla
Apr 16, 2026
Aug 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Joomla! before 1.0.11 omits some checks for whether _VALID_MOS is defined, which allows attackers to have an unknown impact, possibly resulting in PHP remote file inclusion.