TI-2016-09057 CVE-2016-11020 · GHSA-gffh-9h9q-xv2h
Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png.
Priority MEDIUM 47
Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png.
Vulnerabilities
7 records
TI-2019-11291 CVE-2019-15120 · GHSA-3m5j-r9wr-wr68
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
Priority LOW 27
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
TI-2017-03673 CVE-2017-5673 · GHSA-ff32-69mc-6jwx
In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject (aka…
Priority LOW 28
In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject (aka topic subject) accepts JavaScript, leading to XSS.
TI-2014-07396 CVE-2014-9103 · GHSA-vhxx-2mfr-ffpp
Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6…
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) index value of an array parameter or the file…
TI-2014-07395 CVE-2014-9102 · GHSA-wfr9-xqjv-8w45
Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla!…
Priority LOW 32
Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the…
TI-2012-04112 CVE-2012-4868 · GHSA-4hq4-8jjj-9p26
SQL injection vulnerability in news.php in the Kunena component 1.7.2 for Joomla! allows…
Priority LOW 35
SQL injection vulnerability in news.php in the Kunena component 1.7.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.
TI-2009-04306 CVE-2009-4550 · GHSA-5qr4-p3v5-ggg7
SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4…
Priority LOW 35
SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter to index.php.