VYPR
← All advisories
High severity8.8NVD Advisory· Published Aug 5, 2019· Updated Jun 17, 2026

CVE-2019-14654

CVE-2019-14654

Description

In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Joomla/Joomla!4 versions
    cpe:2.3:a:joomla:joomla\!:3.9.7:-:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:joomla:joomla\!:3.9.7:-:*:*:*:*:*:*
    • cpe:2.3:a:joomla:joomla\!:3.9.7:rc:*:*:*:*:*:*
    • cpe:2.3:a:joomla:joomla\!:3.9.8:*:*:*:*:*:*:*
    • (no CPE)range: 3.9.7, 3.9.8
  • Joomla!/Joomla!description

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.