Skip to content

Joomla exploits

Joomla JLex Review 6.0.1 – Reflected XSS

Medium

Joomla iProperty Real Estate 4.1.1 – Reflected XSS

Medium

Joomla Solidres 2.13.3 – Reflected XSS

Medium

Joomla HikaShop 4.7.4 – Reflected XSS

Medium

Joomla VirtueMart Shopping Cart 4.0.12 – Reflected XSS

Medium

Joomla! com_booking component 2.4.9 – Information Leak (Account enumeration)

High

Joomla! v4.2.8 – Unauthenticated information disclosure

CVE-2023-23752 · High

Joomla Plugin SexyPolling 2.1.7 – SQLi

High

Balbooa Joomla Forms Builder 2.0.6 – SQL Injection (Unauthenticated)

Critical

Joomla JCK Editor 6.4.4 – ‘parent’ SQL Injection (2)

CVE-2018-17254 · Critical

Joomla! Component GMapFP 3.5 – Unauthenticated Arbitrary File Upload

CVE-2020-23972 · Critical

Joomla Plugin Simple Image Gallery Extended (SIGE) 3.5.3 – Multiple Vulnerabilities

High

Joomla! paGO Commerce 2.5.9.0 – SQL Injection (Authenticated)

Critical

Joomla! J2 JOBS 1.3.0 – ‘sortby’ Authenticated SQL Injection

Critical

Joomla! J2 Store 3.3.11 – ‘filter_order_Dir’ Authenticated SQL Injection

Critical

Joomla! Plugin XCloner Backup 3.5.3 – Local File Inclusion (Authenticated)

High

Joomla! com_fabrik 3.9.11 – Directory Traversal

High

Joomla! Component GMapFP 3.30 – Arbitrary File Upload

Critical

Joomla! com_hdwplayer 4.2 – ‘search.php’ SQL Injection

Critical

Joomla! Component ACYMAILING 3.9.0 – Unauthenticated Arbitrary File Upload

Critical

Joomla! Component com_newsfeeds 1.0 – ‘feedid’ SQL Injection

Critical

Joomla! 3.9.0 < 3.9.7 - CSV Injection

CVE-2019-12765 · High

Joomla! 3.4.6 – Remote Code Execution (Metasploit)

Critical

Joomla! 3.4.6 – Remote Code Execution

Critical

Joomla! 3.4.6 – ‘configuration.php’ Remote Code Execution

Critical

Joomla! component com_jsjobs 1.2.6 – Arbitrary File Deletion

High

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 – ‘customfields.php’ SQL Injection

Critical

Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 – ‘ticket.php’ Arbitrary File Deletion

High

Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 – ‘ticketreply.php’ SQL Injection

Critical

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 – ‘cities.php’ SQL Injection

Critical

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – Arbitrary File Download

High

Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – SQL Injection

Critical

Joomla! Component ARI Quiz 3.7.4 – SQL Injection

Critical

Joomla! Component JiFile 2.3.1 – Arbitrary File Download

High

Joomla! Core 1.5.0 – 3.9.4 – Directory Traversal / Authenticated Arbitrary File Deletion

CVE-2019-10945 · High

Joomla! Component J2Store < 3.3.7 - SQL Injection

CVE-2019-9184 · Critical

Joomla! Component J-CruisePortal 6.0.4 – SQL Injection

Critical

Joomla! Component JHotelReservation 6.0.7 – SQL Injection

Critical

Joomla! Component vReview 1.9.11 – SQL Injection

Critical

Joomla! Component vWishlist 1.0.1 – SQL Injection

Critical

Joomla! Component J-BusinessDirectory 4.9.7 – ‘type’ SQL Injection

Critical

Joomla! Component J-ClassifiedsManager 3.0.5 – SQL Injection

Critical

Joomla! Component JMultipleHotelReservation 6.0.7 – SQL Injection

Critical

Joomla! Component vAccount 2.0.2 – ‘vid’ SQL Injection

Critical

Joomla! Component vBizz 1.0.7 – Remote Code Execution

Critical

Joomla! Component vBizz 1.0.7 – SQL Injection

Critical

Joomla! Component VMap 1.9.6 – SQL Injection

Critical

Joomla! Component vRestaurant 1.9.4 – SQL Injection

Critical

Joomla! Component Easy Shop 1.2.3 – Local File Inclusion

High

Joomla! Core 3.9.1 – Persistent Cross-Site Scripting in Global Configuration Textfilter Settings

CVE-2019-6263 · High