Vulnerabilities

Joomla! Joomla!

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

653CVEs

CVE-2010-0456

SQL injection vulnerability in the indianpulse Game Server (com_gameserver) component 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the grp parameter in a gameserver action to index.php.

Published 2010-01-28 · Modified

7.51 PoCEPSS 0.010

CVE-2010-0459

SQL injection vulnerability in the Mochigames (com_mochigames) component 0.51 and possibly other versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

Published 2010-01-28 · Modified

7.51 PoCEPSS 0.010

CVE-2010-0632

SQL injection vulnerability in the Parkview Consultants SimpleFAQ (com_simplefaq) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a display action to index.php.

Published 2010-02-12 · Modified

7.51 PoCEPSS 0.010

CVE-2010-1739

SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the feedid parameter in a categories action to index.php.

Published 2010-05-06 · Modified

7.51 PoCEPSS 0.010

CVE-2008-6852

SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

Published 2009-07-07 · Modified

7.51 PoCEPSS 0.010

CVE-2010-1877

SQL injection vulnerability in the JTM Reseller (com_jtm) component 1.9 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the author parameter in a search action to index.php.

Published 2010-05-11 · Modified

7.51 PoCEPSS 0.010

CVE-2010-2679

SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.

Published 2010-07-08 · Modified

7.51 PoCEPSS 0.010

CVE-2010-2845

SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a category action to index.php.

Published 2010-07-23 · Modified

7.51 PoCEPSS 0.010

CVE-2010-2910

SQL injection vulnerability in the Ozio Gallery (com_oziogallery) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.

Published 2010-07-28 · Modified

7.51 PoCEPSS 0.010

CVE-2010-2919

SQL injection vulnerability in the StaticXT (com_staticxt) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

Published 2010-07-30 · Modified

7.51 PoCEPSS 0.010

CVE-2010-2921

SQL injection vulnerability in the Golf Course Guide (com_golfcourseguide) component 0.9.6.0 beta and 1 beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a golfcourses action to index.php.

Published 2010-07-30 · Modified

7.51 PoCEPSS 0.010

CVE-2010-2923

SQL injection vulnerability in the YouTube (com_youtube) component 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id_cate parameter to index.php.

Published 2010-07-30 · Modified

7.51 PoCEPSS 0.010

CVE-2009-3971

SQL injection vulnerability in the jTips (com_jtips) component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the season parameter in a ladder action to index.php.

Published 2009-11-18 · Modified

7.51 PoCEPSS 0.010

CVE-2009-3972

SQL injection vulnerability in the Q-Proje Siirler Bileseni (com_siirler) component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php.

Published 2009-11-18 · Modified

7.51 PoCEPSS 0.010

CVE-2010-1045

SQL injection vulnerability in the Productbook (com_productbook) component 1.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php. NOTE: some of these details are obtained from third party information.

Published 2010-03-22 · Modified

7.51 PoCEPSS 0.010

CVE-2010-2622

SQL injection vulnerability in the Joomanager component, possibly 1.1.1, for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

Published 2010-07-02 · Modified

7.51 PoCEPSS 0.010

CVE-2010-3211

Multiple SQL injection vulnerabilities in the JE FAQ Pro (com_jefaqpro) component 1.5.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via category categorylist operations with (1) the catid parameter or (2) the catid parameter in a lists action.

Published 2010-09-03 · Modified

7.51 PoCEPSS 0.010

CVE-2009-4550

SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter to index.php.

Published 2010-01-04 · Modified

7.51 PoCEPSS 0.010

CVE-2010-1480

SQL injection vulnerability in the RokModule (com_rokmodule) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the module parameter to index.php. NOTE: some of these details are obtained from third party information.

Published 2010-04-19 · Modified

7.52 PoCEPSS 0.010

CVE-2010-1559

SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a speakerpopup action to index.php. NOTE: some of these details are obtained from third party information.

Published 2010-04-27 · Modified

7.51 PoCEPSS 0.010

CVE-2009-3334

SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component (aka JINC or com_jinc) component 0.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a messages action to index.php.

Published 2009-09-23 · Modified

7.51 PoCEPSS 0.010

CVE-2009-3644

SQL injection vulnerability in the Soundset (com_soundset) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to index.php.

Published 2009-10-09 · Modified

7.51 PoCEPSS 0.010

CVE-2010-1434

Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.

Published 2021-06-21 · Modified

7.5EPSS 0.009

CVE-2008-7169

SQL injection vulnerability in Jabode horoscope extension (com_jabode) for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.

Published 2009-09-08 · Modified

7.51 PoCEPSS 0.009

CVE-2010-2690

SQL injection vulnerability in the JOOFORGE Gamesbox (com_gamesbox) component 1.0.2, and possibly earlier, for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a consoles action to index.php.

Published 2010-07-09 · Modified

7.51 PoCEPSS 0.009

CVE-2009-2601

SQL injection vulnerability in the Joomlaequipment (aka JUser or com_juser) component 2.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a show_profile action to index.php.

Published 2009-07-27 · Modified

7.51 PoCEPSS 0.009

CVE-2009-3335

SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Name field.

Published 2009-09-24 · Modified

7.51 PoCEPSS 0.009

CVE-2009-2567

SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.

Published 2009-07-22 · Modified

7.51 PoCEPSS 0.009

CVE-2010-4929

SQL injection vulnerability in the Joostina (com_ezautos) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the firstCode parameter in a helpers action to index.php.

Published 2011-10-09 · Modified

7.51 PoCEPSS 0.009

CVE-2010-4944

SQL injection vulnerability in the Elite Experts (com_elite_experts) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showExpertProfileDetailed action to index.php.

Published 2011-10-09 · Modified

7.51 PoCEPSS 0.009

CVE-2010-5022

SQL injection vulnerability in the JExtensions JE Story Submit (com_jesubmit) component 1.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the view parameter to index.php.

Published 2011-11-02 · Modified

7.51 PoCEPSS 0.009

CVE-2009-3964

SQL injection vulnerability in the NinjaMonials (com_ninjacentral) component 1.1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php.

Published 2009-11-18 · Modified

7.51 PoCEPSS 0.009

CVE-2009-4200

SQL injection vulnerability in the Seminar (com_seminar) component 1.28 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a View_seminar action to index.php.

Published 2009-12-04 · Modified

7.51 PoCEPSS 0.009

CVE-2009-2290

SQL injection vulnerability in the Boy Scout Advancement (com_bsadv) component 0.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) account or (2) event task to index.php.

Published 2009-07-01 · Modified

7.51 PoCEPSS 0.009

CVE-2010-3422

SQL injection vulnerability in the JGen (com_jgen) component 0.9.33 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.

Published 2010-09-16 · Modified

7.51 PoCEPSS 0.009

CVE-2010-4938

SQL injection vulnerability in the Weblinks (com_weblinks) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a categories action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Published 2011-10-09 · Modified

7.51 PoCEPSS 0.009

CVE-2009-4217

SQL injection vulnerability in the Itamar Elharar MusicGallery (com_musicgallery) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an itempage action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Published 2009-12-07 · Modified

7.51 PoCEPSS 0.009

CVE-2012-1562

Joomla! core before 2.5.3 allows unauthorized password change.

Published 2020-01-15 · Modified

7.5EPSS 0.009

CVE-2023-40626

[20231101] - Core - Exposure of environment variables

Published 2023-11-29 · Modified

7.5EPSS 0.008

CVE-2023-23755

[20230502] - Core - Bruteforce prevention within the mfa screen