CVE-2015-8562
HighSummary
Joomla! versions 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header.
Risk Assessment
Attackers can exploit this vulnerability to execute code remotely, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to update Joomla! to version 3.4.6 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Joomla!
See all- CVE-2016-8870High
The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.
- CVE-2015-8769High
SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2015-8565High
A directory traversal vulnerability in Joomla! versions 3.2.0 through 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
- CVE-2015-8564High
Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.
- CVE-2015-7297High
Joomla! versions 3.2 before 3.4.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2014-6632High
Joomla! versions 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allow remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.
- CVE-2026-65760Critical
Improper access checks in the Easy Store extension (versions 1.0.0-2.0.1) for Joomla allow logged-in users to retrieve order and customer information of any order in the system.
- CVE-2026-48904Critical
Vulnerability in Joomla! due to improper access control in the com_users group editing webservice endpoint. Allows privilege escalation.
- CVE-2026-48899Critical
An improper access check allows privilege escalation through the com_users batch task.
- CVE-2026-48898Critical
An improper access check in the com_users batch task allows privilege escalation.
Original NVD description (English source)
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.