Vulnerabilities

TI-2026-17418 CVE-2026-21626 · GHSA-xfjv-gcf8-3jqc

Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla

MEDIUM 46

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00409 Published 2026-02-06 No fix listed CWE-200

TI-2026-17417 CVE-2026-21625 · GHSA-9ff2-h59x-3rvx

Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla

LOW 22

User provided uploads to the Easy Discuss component for Joomla aren't properly validated.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00385 Published 2026-01-16 No fix listed CWE-434

TI-2026-17416 CVE-2026-21624 · GHSA-8w73-pq5f-qccf

Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla

MEDIUM 42

Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.

CVSS 4.0CRITICAL 9.4 Network Low privileges User interaction EPSS 0.00197 Published 2026-01-16 No fix listed CWE-79

TI-2026-17415 CVE-2026-21623 · GHSA-9h7p-fwvj-rw42

Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla

MEDIUM 42

Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.

CVSS 4.0CRITICAL 9.4 Network Low privileges User interaction EPSS 0.00197 Published 2026-01-16 No fix listed CWE-79

TI-2025-34123 CVE-2025-54294 · GHSA-45cc-pw58-m655

Extension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for Joomla

MEDIUM 48

A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00369 Published 2025-07-23 No fix listed CWE-89

TI-2023-28432 CVE-2023-51810 · GHSA-rp86-4jx3-w8j2

SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10…

MEDIUM 41

SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information via a crafted request to the search parameter in the Users module.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01138 Published 2024-01-16 No fix listed CWE-89

TI-2018-03816 CVE-2018-5263 · GHSA-m79r-w432-wc55

The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.

LOW 28

The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01581 Published 2018-01-08 No fix listed CWE-79

TI-2015-06091 CVE-2015-7324 · GHSA-mv48-x4rr-23wh

Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the…

LOW 31

Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01785 Published 2017-12-27 No fix listed CWE-79

TI-2014-01439 CVE-2014-1837 · GHSA-3f7c-2fhm-xwf2

Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento)…

LOW 22

Cross-site scripting (XSS) vulnerability in the StackIdeas Komento (com_komento) component before 1.7.4 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors related to "checking new comm…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01161 Published 2014-01-30 No fix listed CWE-79

TI-2014-00736 CVE-2014-0793 · GHSA-55fx-8656-67xw

Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento…

LOW 23

Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) lati…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.017 Published 2014-01-30 No fix listed CWE-79

Vulnerabilities

Filters