CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 2CVE-2008-6653 – Joomla! Component Webhosting - 'catid' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2008-6653
SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. Vulnerabilidad de inyección SQL en webhosting.php en el modulo Webhosting (com_webhosting) anteriores a v1.1 RC7 para Joomla! y Mambo permite a atacantes remotos ejecutar comando SQL de forma arbitraria a través del parámetro "catid" a index.php. • https://www.exploit-db.com/exploits/5527 http://forum.wh-com.de/index.php?topic=497.0 http://osvdb.org/50423 http://www.securityfocus.com/bid/29000 https://exchange.xforce.ibmcloud.com/vulnerabilities/42124 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2008-6489 – Joomla! Component MyAlbum 1.0 - 'album' SQL Injection
https://notcve.org/view.php?id=CVE-2008-6489
SQL injection vulnerability in MyAlbum component (com_myalbum) 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the album parameter to index.php. Vulnerabildiad de inyección SQL en el componente MyAlbum (com_myalbum) 1.0 para Joomla!, permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro "album" a indexl.php. • https://www.exploit-db.com/exploits/5318 http://www.securityfocus.com/bid/28496 https://exchange.xforce.ibmcloud.com/vulnerabilities/41510 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 6%CPEs: 2EXPL: 3CVE-2008-6482 – Joomla! Component Flash Tree Gallery 1.0 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2008-6482
PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (com_treeg) component 1.0 for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfig_live_site parameter. Vulnerabilidad de inclusión remota de archivos en PHP en admin.treeg.php en el componente Flash Tree Gallery (com_treeg) v1.0 para Joomla!, cuando register_globals está habilitado, permite a atacantes remotos ejecutar código PHP de su elección mediante el parámetro mosConfig_live_site. • https://www.exploit-db.com/exploits/6928 http://osvdb.org/49499 http://secunia.com/advisories/32520 http://www.securityfocus.com/bid/32041 https://exchange.xforce.ibmcloud.com/vulnerabilities/46260 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 3.5EPSS: 0%CPEs: 35EXPL: 0CVE-2008-6299
https://notcve.org/view.php?id=CVE-2008-6299
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) the title and description parameters to the com_weblinks module and (2) unspecified vectors in the com_content module related to "article submission." Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados - XSS - en Joomla! v1.5.7 y anteriores, permite a usuarios autentificados remotos inyectar una secuencia de comandos web o HTML a través de (1) los parámetros "title" y "descripción" en el módulo com_weblinks y (2) vectores no especificados cen el modulo com_content relativo a "article submission.". • http://developer.joomla.org/security/news/283-20081101-core-comcontent-xss-vulnerability.html http://developer.joomla.org/security/news/284-20081102-core-comweblinks-xss-vulnerability.html http://secunia.com/advisories/32622 http://www.joomla.org/announcements/release-news/5219-joomla-158-released.html http://www.securityfocus.com/bid/32263 http://www.vupen.com/english/advisories/2008/3104 https://exchange.xforce.ibmcloud.com/vulnerabilities/46523 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 2CVE-2009-0726 – Joomla! Component gigCalendar 1.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2009-0726
SQL injection vulnerability in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the gigcal_gigs_id parameter in a details action to index.php. Vulnerabilidad de inyección SQL en el componente GigCalendar (com_gigcal) v1.0 para Mambo y Joomla!, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro gigcal_gigs_id en una acción details en index.php. • https://www.exploit-db.com/exploits/7746 http://www.securityfocus.com/bid/33241 https://exchange.xforce.ibmcloud.com/vulnerabilities/47919 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •