CVE-2008-6299

Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) the title and description parameters to the com_weblinks module and (2) unspecified vectors in the com_content module related to "article submission."

• CWE-79

• http://developer.joomla.org/security/news/283-20081101-core-comcontent-xss-vulnerability.htmlPatch, Vendor Advisory
• http://developer.joomla.org/security/news/284-20081102-core-comweblinks-xss-vulnerability.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/32622Vendor Advisory
• http://www.joomla.org/announcements/release-news/5219-joomla-158-released.html
• http://www.securityfocus.com/bid/32263
• http://www.vupen.com/english/advisories/2008/3104Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46523
• http://developer.joomla.org/security/news/283-20081101-core-comcontent-xss-vulnerability.htmlPatch, Vendor Advisory
• http://developer.joomla.org/security/news/284-20081102-core-comweblinks-xss-vulnerability.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/32622Vendor Advisory
• http://www.joomla.org/announcements/release-news/5219-joomla-158-released.html
• http://www.securityfocus.com/bid/32263
• http://www.vupen.com/english/advisories/2008/3104Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46523

Published

Feb 26, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-6293admin/Index.php in Acc Real Estate 4.0 allows remote attacke…
• CVE-2008-6294admin/Index.php in Acc Statistics 1.1 allows remote attacker…
• CVE-2008-6295Multiple cross-site scripting (XSS) vulnerabilities in Camer…
• CVE-2008-6296admin.php in Maran PHP Shop allows remote attackers to bypas…
• CVE-2008-6297Cross-site scripting (XSS) vulnerability in order.php in DHC…
• CVE-2008-6298Unspecified vulnerability in sISAPILocation before 1.0.2.2 a…
• CVE-2008-6300Galatolo WebManager 1.3a allows remote attackers to bypass a…
• CVE-2008-6301SQL injection vulnerability in shoutbox_view.php in the Smal…
• CVE-2008-6302TurnkeyForms Local Classifieds allows remote attackers to by…
• CVE-2008-6303SQL injection vulnerability in tourview.php in ToursManager …
• CVE-2008-6304SQL injection vulnerability in xt:Commerce before 3.0.4 Sp2.…
• CVE-2008-6305PHP remote file inclusion vulnerability in init.php in Free …