CVE-2011-3595

MediumCVSS 5.4/10Last modified Jun 16, 2026

Description

Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Joomla!	Joomla!	<= 1.7.0

References

http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.7.0-stable%5D_cross_site_scripting%28XSS%29Exploit, Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/10/04/7Exploit, Mailing List, Third Party Advisory
https://www.rapid7.com/db/vulnerabilities/joomla-20110902-core-xss-vulnerabilityThird Party Advisory
http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.7.0-stable%5D_cross_site_scripting%28XSS%29Exploit, Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/10/04/7Exploit, Mailing List, Third Party Advisory
https://www.rapid7.com/db/vulnerabilities/joomla-20110902-core-xss-vulnerabilityThird Party Advisory

Timeline

Published: Jan 22, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-35967.5Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.CVE-2011-35977.5Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via CVE-2011-35984.3Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML CVE-2011-35995.8The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it ea CVE-2011-36007.5The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations CVE-2011-36017.5Buffer overflow in the process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to execute arbitr CVE-2011-36026.4Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite CVE-2011-36034.4The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, which causes the radvd da CVE-2011-36047.5The process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to cause a denial of service (stack-CVE-2011-36055.0The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cau CVE-2011-36065.4A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attac CVE-2011-36074.4Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when t