CVE-2014-4960
Last modified
CVE-2014-4960 is a vulnerability of currently unknown severity. Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.. EPSS estimates a 2.35% chance of exploitation in the next 30 days.
Description
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Joomlaboat | Com Youtubegallery | 3.9.0 |
| Joomlaboat | Com Youtubegallery | 3.9.2 |
| Joomlaboat | Com Youtubegallery | 3.9.3 |
| Joomlaboat | Com Youtubegallery | 3.9.4 |
| Joomlaboat | Com Youtubegallery | 3.9.5 |
| Joomlaboat | Com Youtubegallery | 3.9.6 |
| Joomlaboat | Com Youtubegallery | 3.9.7 |
| Joomlaboat | Com Youtubegallery | 3.9.8 |
| Joomlaboat | Com Youtubegallery | 3.9.9 |
| Joomlaboat | Com Youtubegallery | 4.0.0 |
| Joomlaboat | Com Youtubegallery | 4.0.1 |
| Joomlaboat | Com Youtubegallery | 4.0.2 |
| Joomlaboat | Com Youtubegallery | 4.0.8 |
| Joomlaboat | Com Youtubegallery | 4.0.9 |
| Joomlaboat | Com Youtubegallery | 4.1.0 |
| Joomlaboat | Com Youtubegallery | 4.1.1 |
| Joomlaboat | Com Youtubegallery | 4.1.2 |
| Joomlaboat | Com Youtubegallery | 4.1.3 |
| Joomlaboat | Com Youtubegallery | 4.1.4 |
| Joomlaboat | Com Youtubegallery | 4.1.5 |
| Joomlaboat | Com Youtubegallery | 4.1.6 |
| Joomlaboat | Com Youtubegallery | 4.1.7 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-4960?
How severe is CVE-2014-4960?
How do I fix CVE-2014-4960?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-4952Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2014-4953Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2014-4954Cross-site scripting (XSS) vulnerability in the PMA_getHtmlF…
- CVE-2014-4955Cross-site scripting (XSS) vulnerability in the PMA_TRI_getR…
- CVE-2014-4958Cross-site scripting (XSS) vulnerability in Telerik UI for A…
- CVE-2014-4959**DISPUTED** SQL injection vulnerability in SQLiteDatabase.j…
- CVE-2014-4962Shopizer 1.1.5 and earlier allows remote attackers to reduce…
- CVE-2014-4963Shopizer 1.1.5 and earlier allows remote attackers to modify…
- CVE-2014-4964Multiple cross-site request forgery (CSRF) vulnerabilities i…
- CVE-2014-4965Multiple cross-site scripting (XSS) vulnerabilities in Shopi…
- CVE-2014-4966Ansible before 1.6.7 does not prevent inventory data with "{…9.8
- CVE-2014-4967Multiple argument injection vulnerabilities in Ansible befor…9.8
Are you affected by CVE-2014-4960?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST