CVE-2014-9103

Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) index value of an array parameter or the filename parameter in the Content-Disposition header to the (2) file or (3) profile image upload functionality.

• CWE-79

• http://packetstormsecurity.com/files/127684/joomlakunena305-xss.txtExploit
• http://www.kunena.org/blog/139-kunena-3-0-6-releasedPatch, Vendor Advisory
• http://www.kunena.org/docs/Kunena_3.0.6_Read_MeVendor Advisory
• http://www.securityfocus.com/bid/68956
• http://packetstormsecurity.com/files/127684/joomlakunena305-xss.txtExploit
• http://www.kunena.org/blog/139-kunena-3-0-6-releasedPatch, Vendor Advisory
• http://www.kunena.org/docs/Kunena_3.0.6_Read_MeVendor Advisory
• http://www.securityfocus.com/bid/68956

Published

Nov 26, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9097Multiple SQL injection vulnerabilities in the Apptha WordPre…
• CVE-2014-9098Multiple cross-site scripting (XSS) vulnerabilities in the A…
• CVE-2014-9099Cross-site request forgery (CSRF) vulnerability in the WhyDo…
• CVE-2014-9100Cross-site scripting (XSS) vulnerability in the WhyDoWork Ad…
• CVE-2014-9101Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-9102Multiple SQL injection vulnerabilities in the Kunena compone…
• CVE-2014-9104Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-9112Heap-based buffer overflow in the process_copy_in function i…
• CVE-2014-9113CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engageme…
• CVE-2014-9114Blkid in util-linux before 2.26rc-1 allows local users to ex…7.8
• CVE-2014-9115SQL injection vulnerability in the rate_picture function in …
• CVE-2014-9116The write_one_header function in mutt 1.5.23 does not proper…