Directory traversal vulnerability in the Bible Study (combiblestudy) component 6.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter in a studieslist action to index.php.
SQL injection vulnerability in the content component (comcontent) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
SQL injection vulnerability in subvotepic.php in the Datsogallery (comdatsogallery) module 1.6 for Joomla! allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
SQL injection vulnerability in the Showroom Joomlearn LMS (comlms) component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the cat parameter in a showTests task.
components/comuser/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows remote attackers to reset the "first enabled user (lowest id)" password, typically for the administrator.
SQL injection vulnerability in the beamospetition (combeamospetition) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pet parameter to index.php.
PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (comfacileforms) component 1.4.4 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the ffcompath parameter.
SQL injection vulnerability in the GameQ (comgameq) component 4.0 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a page action to index.php.
SQL injection vulnerability in the iJoomla News Portal (comnewsportal) component 1.0 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
SQL injection vulnerability in the Simple Shop Galore (comsimpleshop) component 3.4 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a browse action to index.php.
SQL injection vulnerability in the Bible Study (combiblestudy) component before 6.0.7c for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a mediaplayer action to index.php.
SQL injection vulnerability in the xsstream-dm (comxsstream-dm) component 0.01 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the movie parameter to index.php.
SQL injection vulnerability in the Alberghi (comalberghi) 2.1.3 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
SQL injection vulnerability in the commezun component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit task.
SQL injection vulnerability in index.php in the comgaleria component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (comricette) 1.0 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in the Facile Forms (comfacileforms) component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
SQL injection vulnerability in index.php in the Gallery (comgallery) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
SQL injection vulnerability in index.php in the comdoc component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the sid parameter in a view task.
SQL injection vulnerability in index.php in the NeoReferences (comneoreferences) 1.3.1 and 1.3.3 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
SQL injection vulnerability in index.php in the Ynews (comynews) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showYNews action.
SQL injection vulnerability in index.php in the amazOOP Awesom! (comawesom) 0.3.2component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter in a viewlist task.
Cross-site scripting (XSS) vulnerability in the Artist avenue (comartistavenue) component for Joomla! and Mambo allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter to index.php.
SQL injection vulnerability in the DhForum (comdhforum) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a grouplist action to index.php.
Cross-site scripting (XSS) vulnerability in the Hotel Booking Reservation System (aka HBS or comhbssearch) component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.
Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or comhbssearch) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) hid, (2) id, and (3) rid parameters to longDesc.php, and the hid parameter to (4) detail.php, (5) detail1.php, (6) detail2.php, (7) detail3.php, (8) detail4.php, (9) detail5.php, (10) detail6.php, (11) detail7.php, and (12) detail8.php, different vectors than CVE-2008-5865, CVE-2008-5874, and CVE-2008-5875.
SQL injection vulnerability in the (1) casinobase (comcasinobase), (2) casinoblackjack (comcasinoblackjack), and (3) casinovideopoker (comcasinovideopoker) components 0.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
SQL injection vulnerability in the Teams (comteams) component 110281008091711 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PlayerID parameter in a player save action to index.php.
SQL injection vulnerability in the CamelcityDB (comcamelcitydb2) component 2.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.