Joomla: community verdicts

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

Lack of validation leads to an XSS vulnerability in the MFA management views.

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

Improper validation leads to a generic XSS vector in the language override feature.

An improper access check allows unauthorized users to access com_privacy datasets.

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

An improper access check allows unauthorized users to access workflow stage and transition information.

An improper access check allows users to display a list of modules in the frontend.

An improper access check allows privileged users to overwrite media files without editing permissions.