CVE-2024-21726

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Inadequate content filtering leads to XSS vulnerabilities in various components.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Joomla! Project	Joomla! CMS	3.7.0-3.10.14; 4.0.0-4.4.2; 5.0.0-5.0.2

References

https://developer.joomla.org/security-centre/929-20240205-core-inadequate-content-filtering-within-the-filter-code.htmlVendor Advisory
https://www.sonarsource.com/blog/joomla-multiple-xss-vulnerabilities/Exploit, Third Party Advisory
https://developer.joomla.org/security-centre/929-20240205-core-inadequate-content-filtering-within-the-filter-code.htmlVendor Advisory

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-217276.1XSS vulnerability in DP Calendar component for Joomla.CVE-2024-217286.1An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that prov CVE-2024-217296.1Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.CVE-2024-21738.8Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access CVE-2024-217305.4The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.CVE-2024-217316.1Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.CVE-2024-217326.1FlyCms through abbaa5a allows XSS via the permission management feature.CVE-2024-217335.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 thr CVE-2024-217345.4SAP Marketing (Contacts App) - version 160, allows an attacker with low privileges to trick a user to open malicious page which could lead t CVE-2024-217357.2SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary autho CVE-2024-217366.5SAP S/4HANA Finance for (Advanced Payment Management) - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. CVE-2024-217379.1In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through vario