YOOtheme Pro extension for Joomla vulnerabilities
4 known vulnerabilities in YOOtheme Pro extension for Joomla from Yootheme.com. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 10.0 Critical severity
YOOtheme Pro extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request sign
- 7.5 High severity
YOOtheme Pro extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.
- 8.6 High severity
YOOtheme Pro extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.
- 7.0 High severity
YOOtheme Pro extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.