MediumCVSS 6.1
EPSS 0.65%
Mambo CMS through 4.6.5 has multiple XSS.
Vendor
mambo vulnerabilities
102 published CVES affecting mambo, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 102
- Critical
- 0
- High
- 67
- Medium
- 33
- Low
- 2
- Unscored
- 0
- CISA KEV
- 0
Products
- mambo 25
- mambo open source 7
- mambo site server 7
- com downloads 2
- com facileforms 2
- mambo calendar 2
- mambo gallery manager 2
- mambo open source 4.5 2
- mostlyce 2
- a6mambocredits component 1
- artlinks component 1
- bayesiannaivefilter 1
- bigape-backup component 1
- catalogshop component 1
- CMS 1
- com awesom 1
- com comments 1
- com comprofiler 1
- com comprofiler component 1
- com detail 1
- com doc 1
- com ewriting 1
- com filebase component 1
- com flippingbook 1
- com gallery 1
- com garyscookbook 1
- com jokes 1
- com mamml 1
- com neogallery 1
- com neoreferences 1
Latest mambo CVEs
Newest publication first · page 1 of 5
-
-
MediumCVSS 5.3 EPSS 1.6%
A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver.
-
HighCVSS 7.5 EPSS 1.0%
SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute arbitrary SQL commands via the ma_cat parameter in a view action to index.php, a different vector than CVE-2007-5177.
-
LowCVSS 2.6 EPSS 1.9%
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) query string to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connecto...
-
HighCVSS 7.5 EPSS 2.3%
PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the ff_compath parameter.
-
MediumCVSS 6.8 EPSS 18.4% Framework module
PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
-
MediumCVSS 4.3 EPSS 0.85%
Cross-site scripting (XSS) vulnerability in the MOStlyContent Editor (MOStlyCE) component before 3.0 for Mambo allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
HighCVSS 7.5 EPSS 1.1%
SQL injection vulnerability in index.php in the FlippingBook (com_flippingbook) 1.0.4 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter.
-
HighCVSS 7.5 EPSS 0.97%
SQL injection vulnerability in the Profiler (com_comprofiler) component in Community Builder for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the user parameter in a userProfile action to index.php.
-
HighCVSS 7.5 EPSS 0.91%
SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php. NOTE: the provenance of this information is unknown; the details a...
-
HighCVSS 7.5 EPSS 0.97%
SQL injection vulnerability in index.php in the eWriting (com_ewriting) 1.2.1 module for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a selectcat action.
-
HighCVSS 7.5 EPSS 1.2%
SQL injection vulnerability in the Garys Cookbook (com_garyscookbook) 1.1.1 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
-
HighCVSS 7.5 EPSS 1.1%
SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a selectcat function, a different vector than CVE-2008-0652.
-
HighCVSS 7.5 EPSS 0.96%
SQL injection vulnerability in the com_salesrep component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the rid parameter in a showrep action to index.php.
-
HighCVSS 7.5 EPSS 0.97%
SQL injection vulnerability in the com_detail component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: this issue might be site-specific. If so, it should not be included in CVE.
-
HighCVSS 7.5 EPSS 0.95%
SQL injection vulnerability in the Facile Forms (com_facileforms) component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
-
HighCVSS 7.5 EPSS 0.93%
SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (com_ricette) 1.0 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter.
-
HighCVSS 7.5 EPSS 1.0%
SQL injection vulnerability in index.php in the com_profile component for Joomla! allows remote attackers to execute arbitrary SQL commands via the oid parameter.
-
HighCVSS 7.5 EPSS 1.2%
SQL injection vulnerability in index.php in the Kemas Antonius com_quran 1.1 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the surano parameter in a viewayat action.
-
HighCVSS 7.5 EPSS 1.1%
SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail task.
-
HighCVSS 7.5 EPSS 1.0%
SQL injection vulnerability in the com_filebase component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the filecatid parameter in a selectfolder action.
-
HighCVSS 7.5 EPSS 0.96%
SQL injection vulnerability in the com_scheduling module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter.
-
HighCVSS 7.5 EPSS 0.97%
SQL injection vulnerability in index.php in the MGFi XfaQ (com_xfaq) 1.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an answer action.
-
HighCVSS 7.5 EPSS 1.00%
SQL injection vulnerability in index.php in the Quiz (com_quiz) 0.81 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the tid parameter in a user_tst_shw action.
-
HighCVSS 7.5 EPSS 1.1%
SQL injection vulnerability in Phil Taylor Comments (com_comments, aka Review Script) 0.5.8.5g and earlier component for Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.