CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23750 – [20230101] - Core - CSRF within post-installation messages
https://notcve.org/view.php?id=CVE-2023-23750
An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages. • https://developer.joomla.org/security-centre/890-20230101-core-csrf-within-post-installation-messages.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27914 – [20221101] - Core - RXSS through reflection of user input in com_media
https://notcve.org/view.php?id=CVE-2022-27914
An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media. Se descubrió un problema en Joomla! 4.0.0 a 4.2.4. • https://developer.joomla.org/security-centre/887-20221101-core-rxss-through-reflection-of-user-input-in-com-media.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27913 – [20221002] - Core - RXSS through reflection of user input in headings
https://notcve.org/view.php?id=CVE-2022-27913
An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components. Se ha detectado un problema en Joomla! versiones 4.2.0 hasta 4.2.3. • https://developer.joomla.org/security-centre/886-20221002-core-reflected-xss-in-various-components.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27912 – [20221001] - Core - Debug Mode leaks full request payloads including passwords
https://notcve.org/view.php?id=CVE-2022-27912
An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests. Se ha detectado un problema en Joomla! versiones 4.0.0 hasta 4.2.3. • https://developer.joomla.org/security-centre/885-20221001-core-disclosure-of-critical-information-in-debug-mode.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23801 – [20220309] - Core - XSS attack vector through SVG
https://notcve.org/view.php?id=CVE-2022-23801
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media. Se ha detectado un problema en Joomla! versiones 4.0.0 hasta 4.1.0. • https://developer.joomla.org/security-centre/878-20220309-core-xss-attack-vector-through-svg.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •