Joomla! vulnerabilities

The register method in the UsersModelRegistration class in Joomla! before version 3.6.4, when registration has been disabled, allows remote attackers to create user accounts due to failure to check the 'Allow User Registration' configuration setting.

SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.

A directory traversal vulnerability in Joomla! versions 3.2.0 through 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.

Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.

Joomla! versions 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header.

Joomla! versions 3.2 before 3.4.4 have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Joomla! versions 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allow remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.

Joomla! Core versions 1.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability of unrestricted uploads of SHTML files. The default list of dangerous files did not include SHTML files, which on servers that execute these files could lead to code execution.

Improper access checks in the Easy Store extension (versions 1.0.0-2.0.1) for Joomla allow logged-in users to retrieve order and customer information of any order in the system.

Vulnerability in Joomla! due to improper access control in the com_users group editing webservice endpoint. Allows privilege escalation.

An improper access check allows privilege escalation through the com_users batch task.

An improper access check in the com_users batch task allows privilege escalation.

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

In Joomla! before version 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.

Joomla! versions 3.4.4 through 3.6.3 allow attackers to reset username, password, and user group assignments, and possibly perform other user account modifications via unspecified vectors.

The register method in the UsersModelRegistration class in Joomla! before version 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.

Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter. The cleanAttribute method removes HTML data URIs, but injected whitespace characters can circumvent that cleanup, causing an XSS vector.

Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter due to an HTML5 entity decode mismatch. The checkAttribute method normalizes an attribute value before testing it against the "javascript:" scheme regex, but without decoding HTML5 entities beforehand, causing an XSS vector.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an MFA authentication bypass vulnerability due to premature issuance of a rememberme cookie. This allows bypassing the multi-factor authentication requirement.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for various webservice edit tasks. An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.

Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have SSRF vectors in various core extensions. URLs used for serverside requests were improperly validated, leading to SSRF vectors.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an arbitrary directory deletion vulnerability via the cache purge action. An improper validation of the cache group name allowed path traversals in the file storage of the caching layer, resulting in arbitrary directory deletions.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for access level webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in access level endpoints.

Joomla! Core has an improper ACL check when injecting schema.org contact data. This allows contact information for inaccessible contact items to be injected into schema.org snippets.

Joomla! Core has an XSS vulnerability through schema.org outputs. Improper escaping flags lead to an XSS vector in schema.org markup outputs.

Joomla! Core has an improper ACL check for custom fields webservice endpoints. Unauthorized users can create fields for inaccessible components.

Joomla! Core has an improper CORS origin validation. An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

Joomla! Core has a response header injection vulnerability in download views. Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have improper ACL checks for batch copy actions. An improper access check allows unauthorized users to perform copy batch operations on uneditable items.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have an MFA authentication bypass vulnerability. Insufficient state checks lead to a vector that allows bypassing 2FA checks.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have improper ACL checks for category webservice endpoints. An improper access check allows unauthorized users to create categories via webservices endpoints.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability related to inconsistent ACL checks for mutating webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives.

Lack of proper escaping in the update list view of the com_installer component in Joomla! leads to an XSS vulnerability. An attacker can inject malicious JavaScript code that will be executed in the administrator's browser.

Lack of proper escaping in the file management view of the com_templates component leads to a Cross-Site Scripting (XSS) vulnerability.

The com_jsjobs component in Joomla version 1.2.6 has an arbitrary file deletion vulnerability. Authenticated attackers can delete files by manipulating custom userfield parameters, sending POST requests with path traversal sequences in the field_2 parameter.

Lack of CSRF token validation in the admin activation endpoint of com_users leads to a CSRF attack vector. An attacker can trick an administrator into performing unauthorized actions.

Lack of output escaping leads to an XSS vector in the readmore links for com_content.

Lack of output escaping leads to an XSS vector in the content history component.

Lack of output escaping leads to an XSS vector in the multilingual associations component.