CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2011-4808 – Joomla! Component HM Community - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-4808
SQL injection vulnerability in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a fnd_home action to index.php. Vulnerabilidad de inyección SQL en el componente HM Community (com_hmcommunity) antes de v1.01 para Joomla! permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro id en una acción fnd_home de index.php. • https://www.exploit-db.com/exploits/18050 http://joomlaextensions.co.in/index.php?option=com_jeshop&view=category_detail&Itemid=118&id=38 http://secunia.com/advisories/46656 http://www.exploit-db.com/exploits/18050 http://www.osvdb.org/76727 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 2CVE-2011-4809 – Joomla! Component HM Community - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-4809
Multiple cross-site scripting (XSS) vulnerabilities in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) language[], (2) university[], (3) persent[], (4) company_name[], (5) designation[], (6) music[], (7) books[], (8) movies[], (9) games[], (10) syp[], (11) ft[], and (12) fa[] parameters in a save task for a profile to index.php. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en el componente HM Community (com_hmcommunity) v1.01 para Joomla!, permite a atacantes remotos ejecutar secuencias de comandos web o HTML de su elección a través de los parámetros (1) language[], (2) university[], (3) persent[], (4) company_name[], (5) designation[], (6) music[], (7) books[], (8) movies[], (9) games[], (10) syp[], (11) ft[], and (12) fa[] en una tarea guardada para un perfil en index.php. • https://www.exploit-db.com/exploits/18050 http://joomlaextensions.co.in/index.php?option=com_jeshop&view=category_detail&Itemid=118&id=38 http://secunia.com/advisories/46656 http://www.exploit-db.com/exploits/18050 http://www.osvdb.org/76726 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •