CVE-2015-7324

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2015/Oct/11Mailing List, Third Party Advisory, VDB Entry
https://stackideas.com/changelog/komento?version=2.0.5Release Notes, Vendor Advisory
https://www.davidsopas.com/komento-joomla-component-persistent-xss/Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Oct/11Mailing List, Third Party Advisory, VDB Entry
https://stackideas.com/changelog/komento?version=2.0.5Release Notes, Vendor Advisory
https://www.davidsopas.com/komento-joomla-component-persistent-xss/Exploit, Third Party Advisory

Timeline

Published: Dec 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-73269.8XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.CVE-2015-73274.3Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to CVE-2015-73284.7Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private ke CVE-2015-73308.8Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet co CVE-2015-73316.6The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --s CVE-2015-73337.8MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported CVE-2015-73347.8MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported CVE-2015-73357.0MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclo CVE-2015-73367.5MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclos CVE-2015-73376.8The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript CVE-2015-73387.2SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php.CVE-2015-73398.8JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/librarie