VYPR
← Joomla

Vendor CVEs

Joomla

All CVEs

1,051 total · sorted by risk
  • CVE-2008-0515Jan 31, 2008
    Joomla
    com_musepoes
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the musepoes (com_musepoes) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an answer action.

  • CVE-2008-0511Jan 31, 2008
    Joomla
    Com Mamml
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the MaMML (com_mamml) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.

  • CVE-2008-0514Jan 31, 2008
    Joomla
    Glossary
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Glossary (com_glossary) 2.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a display action.

  • CVE-2008-0512Jan 31, 2008
    Mambo (software)
    com_fq
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the fq (com_fq) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.

  • CVE-2008-0518Jan 31, 2008
    Joomla
    Recipes
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Recipes (com_recipes) 1.00 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

  • CVE-2008-0517Jan 31, 2008
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote attackers to execute arbitrary SQL commands via the objid parameter in a contact showObject action.

  • CVE-2008-0519Jan 31, 2008
    Joomla
    Com Jokes
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Atapin Jokes (com_jokes) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a CatView action.

  • CVE-2008-0510Jan 31, 2008
    Mambo (software)
    Mambo
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.

  • CVE-2007-6663Jan 4, 2008
    Pragmatic Utopia
    Pu Arcade
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com_puarcade) 2.0.3, 2.1.2, and 2.1.3 Beta component for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter to index.php.

  • CVE-2007-6555Dec 28, 2007
    Joomla
    mosDirectory
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter.

  • CVE-2007-6362Dec 15, 2007
    Mambo (software)
    RSGallery
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in the RSGallery (com_rsgallery) 2.0 beta 5 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an inline page action.

  • CVE-2007-6272Dec 7, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Joomla! 1.5 RC3 allow remote attackers to execute arbitrary SQL commands via (1) the view parameter to the com_content component, (2) the task parameter to the com_search component, or (3) the option parameter in a search…

  • CVE-2007-6027Nov 20, 2007
    Joomla
    com_jjgallery
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com_jjgallery) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2007-5427Oct 12, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the com_search component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter. NOTE: this might be related to CVE-2007-4189.1.

  • CVE-2007-5410Oct 12, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader (com_wmtrssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.

  • CVE-2007-5309Oct 9, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com_wmtgallery) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.

  • CVE-2007-5310Oct 9, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com_wmtportfolio) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2007-4781Sep 10, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.05

    administrator/index.php in the installer component (com_installer) in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote authenticated administrators to upload arbitrary files to tmp/ via the "Upload Package File" functionality, which is accessible when com_installer is the value…

  • CVE-2007-4502Aug 23, 2007
    Joomla
    Bibtex
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in the BibTeX component (com_jombib) 1.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the afilter parameter.

  • CVE-2007-4503Aug 23, 2007
    Joomla
    Nice Talk
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in index.php in the Nice Talk component (com_nicetalk) 0.9.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the tagid parameter.

  • CVE-2007-4506Aug 23, 2007
    Joomla
    Neorecruit
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in index.php in the NeoRecruit component (com_neorecruit) 1.4 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an offer_view action.

  • CVE-2007-4509Aug 23, 2007
    Joomla
    Eventlist
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in the EventList component (com_eventlist) 0.8 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the did parameter in a details action.

  • CVE-2007-4186Aug 8, 2007
    Joomla
    Tour De France Pool
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in admin.tour_toto.php in the Tour de France Pool (com_tour_toto) 1.0.1 module for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2007-4046Jul 27, 2007
    Joomla
    Pony Gallery
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.

  • CVE-2007-3249Jun 18, 2007
    Joomla
    Letterman Subscriber
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mod_lettermansubscribe.php in the Letterman Subscriber (mod_letterman) before 1.2.5 module for Joomla! allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter.

  • CVE-2007-3130Jun 8, 2007
    Joomla
    OpenWiki
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in the OpenWiki (formerly JD-Wiki) component (com_jd-wiki) 1.0.2, and possibly earlier, for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) dwpage.php or (2)…

  • CVE-2007-2933May 31, 2007
    Joomla
    Phil-a-Form
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the form_id parameter.

  • CVE-2007-2792May 22, 2007
    Joomla
    com_yanc
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in the Yet another Newsletter Component (aka YaNC or com_yanc) component before 1.5 beta 3 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter to index.php. NOTE: some of these details are obtained…

  • CVE-2007-2319Apr 26, 2007
    Joomla
    AutoStand
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in the AutoStand 1.1 and earlier module for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to mod_as_category.php in (1) modules/mod_as_category/ or (2) modules/.

  • CVE-2007-2143Apr 19, 2007
    Joomla
    Be2004-2
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in index.php in the Be2004-2 template for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2007-2089Apr 18, 2007
    Joomla
    Article
    risk 0.03cvss —epss 0.06

    Multiple PHP remote file inclusion vulnerabilities in the Jx Development Article 1.1 and earlier component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to com_articles.php in (1) components/ or (2)…

  • CVE-2007-1704Mar 27, 2007
    Joomla
    Car Manager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Car Manager (com_resman) 1.1 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-1703Mar 27, 2007
    Joomla
    RWCards (com_rwcards)
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in index.php in the RWCards (com_rwcards) 2.4.3 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter.

  • CVE-2006-6962Jan 29, 2007
    Joomla
    RSGallery2
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in rsgallery2.html.php in the RS Gallery2 component (com_rsgallery2) 1.11.2 for Joomla! allows attackers to execute arbitrary PHP code via the mosConfig_absolute_path parameter. NOTE: this issue may overlap CVE-2006-5047.

  • CVE-2006-6051Nov 22, 2006
    Joomla
    MosReporter
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in reporter.logic.php in the MosReporter (com_reporter) component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-5096Sep 29, 2006
    Joomla
    VirtueMart
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in VirtueMart (formerly known as mambo-phpShop) Joomla! eCommerce Edition CMS 1.0.11, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the Itemid parameter in a (1)…

  • CVE-2006-5045Sep 27, 2006
    Joomla
    PollXT
    risk 0.03cvss —epss 0.06

    Unspecified vulnerability in PollXT component (com_pollxt) 1.22.07 and earlier for Joomla! has unspecified impact and attack vectors, probably related to PHP remote file inclusion in the mosConfig_absolute_path to conf.pollxt.php.

  • CVE-2006-5043Sep 27, 2006
    Joomlaboard
    Joomlaboard
    risk 0.03cvss —epss 0.04

    Multiple PHP remote file inclusion vulnerabilities in the Joomlaboard Forum Component (com_joomlaboard) before 1.1.2 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the sbp parameter to (1) file_upload.php or (2) image_upload.php, a variant of…

  • CVE-2006-5044Sep 27, 2006
    Joomla
    Prince Clan Chess Component
    risk 0.03cvss —epss 0.02

    Unspecified vulnerability in Prince Clan (Princeclan) Chess component (com_pcchess) 0.8 and earlier for Mambo and Joomla! has unspecified impact and attack vectors.

  • CVE-2006-4553Sep 6, 2006
    Joomla
    Com Comprofiler
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in plugin.class.php in the com_comprofiler Components 1.0 RC2 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-4348Aug 24, 2006
    Joomla
    Kochsuite
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in config.kochsuite.php in the Kochsuite (com_kochsuite) 0.9.4 component for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-4242Aug 21, 2006
    Joomla
    JIM
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in install.jim.php in the JIM 1.0.1 component for Joomla or Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-4129Aug 14, 2006
    Joomla
    Webring Component
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in admin.webring.docs.php in the Webring Component (com_webring) 1.0 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the component_dir parameter.

  • CVE-2006-4074Aug 11, 2006
    JoomlaDeveloping
    JD-Wiki
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and earlier for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3969Aug 1, 2006
    Joomla
    Colophon
    risk 0.03cvss —epss 0.03

    PHP remote file inclusion vulnerability in administrator/components/com_colophon/admin.colophon.php in Colophon 1.2 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3774Jul 24, 2006
    Joomla
    Performs Component
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in performs.php in the perForms component (com_performs) 1.0 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3750Jul 21, 2006
    Hashcash
    Hashcash
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in server.php in the Hashcash Component (com_hashcash) 1.2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2006-3530Jul 12, 2006
    Joomla
    PccookBook
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in com_pccookbook/pccookbook.php in the PccookBook Component for Mambo and Joomla 0.3 and possibly up to 1.3.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfig_absolute_path…

  • CVE-2025-22204Feb 4, 2025
    Joomla
    sourcerer
    risk 0.01cvss —epss 0.01

    Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability.

  • CVE-2021-26030Apr 14, 2021
    Joomla
    Joomla!
    risk 0.01cvss —epss 0.82

    An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page

Page 13 of 22