Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Joomla\!
(Joomla)Repositories | https://github.com/joomla/joomla-cms |
#Vulnerabilities | 254 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2016-12-30 | CVE-2016-10045 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. | Joomla\!, Phpmailer, Wordpress | 9.8 | ||
2021-06-21 | CVE-2010-1435 | Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable. | Joomla\! | 9.8 | ||
2021-08-24 | CVE-2021-26040 | An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command. | Joomla\! | 9.1 | ||
2020-03-16 | CVE-2020-10239 | An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users. | Joomla\! | 8.8 | ||
2020-04-21 | CVE-2020-11889 | An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups. | Joomla\! | 5.3 | ||
2020-04-21 | CVE-2020-11891 | An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups. | Joomla\! | 5.3 | ||
2020-07-15 | CVE-2020-15698 | An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials | Joomla\! | 5.3 | ||
2020-12-28 | CVE-2020-35614 | An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page. | Joomla\! | 5.3 | ||
2021-07-07 | CVE-2021-26036 | An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table. | Joomla\! | 7.5 | ||
2021-07-07 | CVE-2021-26037 | An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked. | Joomla\! | 5.3 |