Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.
Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
The Aardvertiser component before 2.2.1 for Joomla! uses insecure permissions (777) in unspecified folders, which allows local users to modify, create, or delete certain files.
Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter to (1) wp-comments-post.php and (2) wp-trackback.php.
Directory traversal vulnerability in the Web TV (comwebtv) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
Directory traversal vulnerability in the JA News (comjanews) component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.
Directory traversal vulnerability in the JE Form Creator (comjeformcr) component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE: the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected.
Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (JwallVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.
SQL injection vulnerability in the PerchaGallery (comperchagallery) component before 1.5b for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an editunidad action to index.php.
SQL injection vulnerability in the casino (comcasino) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) category or (2) player action to index.php.
Directory traversal vulnerability in the JoomlaPraise Projectfork (comprojectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
SQL injection vulnerability in the iJoomla RSS Feeder (comijoomlarss) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in an xml action to index.php.
SQL injection vulnerability in the Jumi (comjumi) component 2.0.3 and possibly other versions for Joomla allows remote attackers to execute arbitrary SQL commands via the fileid parameter to index.php.
Directory traversal vulnerability in includes/fileincluder.php in the Ideal MooFAQ (commoofaq) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
SQL injection vulnerability in the ComSchool (comschool) component 1.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the classid parameter in a showclass action to index.php.
Cross-site scripting (XSS) vulnerability in the JAPurity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.
Cross-site scripting (XSS) vulnerability in the administrator panel in the comusers core component for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
SQL injection vulnerability in the JoomlaMe AgoraGroups (aka AG or comagoragroup) component 0.3.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a groupdetail action to index.php.
SQL injection vulnerability in MyAlbum component (commyalbum) 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the album parameter to index.php.
PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka comgooglebase or Froogle) component 1.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter.
PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (comtreeg) component 1.0 for Joomla!, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfiglivesite parameter.
SQL injection vulnerability in the Versioning component (comversioning) 1.0.2 in Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in an edit task to index.php.
SQL injection vulnerability in the PrayerCenter (comprayercenter) component 1.4.9 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewrequest action to index2.php.
SQL injection vulnerability in the MyContent (commycontent) component 1.1.13 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (comongumatimesheet20) 2.0 4b component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter.
SQL injection vulnerability in the Volunteer Management System (comvolunteer) module 2.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the jobid parameter in a jobshow action to index.php.
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) the title and description parameters to the comweblinks module and (2) unspecified vectors in the comcontent module related to "article submission."
Multiple SQL injection vulnerabilities in the GigCalendar (comgigcal) component 1.0 for Mambo and Joomla!, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the gigcal venuesid parameter in a details action to index.php, which is not properly handled by venuedetails.php, and (2) the gigcalbandsid parameter in a details action to index.php, which is not properly handled by banddetails.php, different vectors than CVE-2009-0726.
SQL injection vulnerability in the GigCalendar (comgigcal) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the gigcalgigsid parameter in a details action to index.php.