According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.10.7 or 4.x prior to 4.1.1. It is, therefore, affected by multiple vulnerabilities.

 - Extracting an specifilcy crafted tar package could write files outside of the intended path. (CVE-2022-23793)

 - Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application. (CVE-2022-23794)

 - A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover. (CVE-2022-23795)

 - Lack of input validation could allow an XSS attack using com_fields. (CVE-2022-23796)

 - Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection. (CVE-2022-23797)

 - Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not. (CVE-2022-23798)

 - Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data. (CVE-2022-23799)

 - Inadequate content filtering leads to XSS vulnerabilities in various components. (CVE-2022-23800)

 - Possible XSS attack vector through SVG embedding in com_media. (CVE-2022-23801)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
113215	Joomla! 4.x < 4.1.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	3/31/2022	3/14/2023	critical
113216	Joomla! 2.5.x < 3.10.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	3/31/2022	3/14/2023	critical

Detections

Analytics

Plugins Search

critical

critical