Zoo extension for Joomla vulnerabilities
3 known vulnerabilities in Zoo extension for Joomla from Yootheme.com. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.6 High severity
Zoo extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.
- 9.3 Critical severity
Zoo extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or esc
- 10.0 Critical severity
Zoo extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.