GCVE - cpe:2.3:a:joomla:joomla\!:3.2.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:joomla:joomla\!:3.2.5:*:*:*:*:*:*:*

part: a version: 3.2.5 update: *

Vendor	Joomla (`6fa59c4b-5b62-59b9-bce0-735b9b6b6c51`)
Product	Joomla! (`10fae64e-55af-54aa-88fc-fe7759e94ebb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-14596`	vulnerable	2026-06-08 05:08:50.200239	Details available In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password. Published: 2017-09-20T18:00:00.000Z Updated: 2024-08-05T19:34:39.270Z Open on db.gcve.eu Reference links https://developer.joomla.org/security-centre/711-20170902-core-ldap-information-disclosure https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/ http://www.securitytracker.com/id/1039407 http://www.securityfocus.com/bid/100898	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-11364`	vulnerable	2026-06-08 05:08:37.434408	Details available The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs. Published: 2017-08-02T14:00:00.000Z Updated: 2024-08-05T18:05:30.495Z Open on db.gcve.eu Reference links https://twitter.com/hanno/status/890281330906247168 https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Hanno-Boeck-Abusing-Certificate-Transparency-Logs.pdf http://www.securitytracker.com/id/1039015 https://developer.joomla.org/security-centre/700-20170704-core-installer-lack-of-ownership-verification.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5397`	vulnerable	2026-06-08 05:06:49.958027	Details available Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload code via unknown vectors. Published: 2015-07-14T16:00:00.000Z Updated: 2024-08-06T06:50:02.518Z Open on db.gcve.eu Reference links http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html http://www.securitytracker.com/id/1032796 http://www.securityfocus.com/bid/76495	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-7228`	vulnerable	2026-06-08 05:05:59.024063	Details available Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive. Published: 2014-11-03T22:00:00.000Z Updated: 2024-08-06T12:40:19.218Z Open on db.gcve.eu Reference links http://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228/ http://developer.joomla.org/security/595-20140903-core-remote-file-inclusion.html https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.