Benjamin Trenkle

**Name of the Vulnerable Software and Affected Versions** Joomla! versions 1.7.0 through 3.9.22 **Description** An issue was discovered in Joomla! due to a lack of input validation while handling ACL rulesets, which can cause write ACL violations. **Recommendations** For versions 1.7.0 through 3.9.22, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions 3.9.7 through 3.9.8 **Description** The issue allows users authorized to create custom fields to manipulate filtering options and inject unvalidated options, potentially leading to remote code execution due to inadequate filtering in subform fields. **Recommendations** For versions 3.9.7 and 3.9.8, update to version 3.9.9 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 3.9.5 **Description** An issue was discovered where the "refresh list of helpsites" endpoint of com users lacks access checks, allowing calls from unauthenticated users. This affects the com users component, specifically the endpoint related to refreshing the list of helpsites. **Recommendations** For versions prior to 3.9.5, update to version 3.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "refresh list of helpsites" endpoint of com users to authenticated users only until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 3.9.4 **Description** An issue was discovered that allows unauthorized access due to the lack of ACL checks in the sample data plugins. **Recommendations** For versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Joomla! Core versions prior to 3.8.8 **Description** An issue in com fields allows users authorized to create custom fields to manipulate filtering options and inject unvalidated options due to inadequate filtering. **Recommendations** For versions prior to 3.8.8, update to version 3.8.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions prior to 3.8.4 **Description** The issue is related to inadequate input filtering in com fields, which leads to an XSS vulnerability in multiple field types, including list, radio, and checkbox. **Recommendations** For versions prior to 3.8.4, update to version 3.8.4 or later to resolve the issue.