CVE 検索

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.

Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

An improper access check allows unauthorized users to access com_privacy datasets.

An improper access check allows users to display a list of modules in the frontend.

An improper access check allows unauthorized users to access workflow stage and transition information.

Improper validation leads to a generic XSS vector in the language override feature.

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

Lack of validation leads to an XSS vulnerability in the MFA management views.

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

An improper access check allows privileged users to overwrite media files without editing permissions.

Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the category_id parameter. Attackers can send GET requests to the events view with malicious SQL code in the category_id parameter to extract sensitive database informati

Lack of input filtering leads to an XSS vector in the HTML filter code.