Joomla ≫ Joomla!

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

An improper access check allows privilege escalation through the com_users batch task.

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.

Lack of output escaping leads to a XSS vector in the pagebreak plugin.

Improper Access Controls allows backend users to overwrite their username when disallowed.

Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.

The Custom Fields component not correctly filter inputs, leading to a XSS vector.

The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.