Helix3 3.1.1 fixes critical Joomla security flaws
JoomShaper has released Helix3 3.1.1 to address critical security vulnerabilities that could let unauthenticated attackers write and delete files on Joomla…
Security
Security releases, vulnerabilities and hardening for Joomla.
Hidden cron jobs can restore malware after Joomla cleanup
A mySites.guru investigation warns that Joomla sites can be reinfected by malicious cron jobs hidden outside the account-level schedules visible in hosting…
OVH falsely flags Joomla backup connector as malware
mySites.guru says OVH mistakenly identified the legitimate Joomla bfnetwork connector file bfRestore.php as malware.
SP Page Builder flaw exploited to create Joomla admins
A critical SP Page Builder vulnerability is being exploited against Joomla sites, allowing unauthenticated attackers to upload PHP files and create hidden…
iCagenda flaw enabled unauthenticated RCE on Joomla 6
mySites.guru has reported a critical iCagenda vulnerability that allowed unauthenticated attackers to upload executable files and achieve remote code execution…
Joomla Framework XSS fixed in cleanAttributes filtering
Joomla! CMS installations running 3.0.0-5.4.5 or 6.0.0-6.1.0 are affected by a Moderate XSS issue in the Framework; upgrade to 5.4.6 or 6.1.1.
Joomla fixes XSS in checkAttribute filtering
Joomla CMS sites running 3.0.0-5.4.5 or 6.0.0-6.1.0 should be upgraded to 5.4.6 or 6.1.1 to address a Moderate-severity XSS vulnerability in the Framewok…
Joomla fixes reset-link encryption downgrade
Administrators running Joomla! CMS 3.9.0-5.4.5 or 6.0.0-6.1.0 should upgrade to 5.4.6,6.1.1 to fix a Low-severity transport encryption downgrade affecting…
Joomla InputFilter cache flaw fixed in 5.4.6 and 6.1.1
Joomla installations running 4.0.0-5.4.5 or 6.0.0-6.1.0 are affected by a cache-key issue in InputFilter; administrators should upgrade to 5.4.6 or 6.1.1, as…
Joomla fixes scheduler access control flaw
Administrators running affected Joomla versions should upgrade to 5.4.6 or 6.1.1 to address an incorrect access control issue in com_scheduler.
Joomla sample data plugins expose access-control flaw
The Joomla project says Joomla! CMS installations running 4.0.0-5.4.5 or 6.0.0-6.1.0 are affected by an access-control flaw in sample data plugins…
Joomla fixes privilege escalation in com_users webservices
Joomla! CMS installations running 4.0.0-5.4.5 or 6.0.0-6.1.0 are affected by a privilege escalation flaw in com_users webservice endpoints. Administrators…