CVE-2015-3619

Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of first_name, last_name and company."

• CWE-79

• http://dev.virtuemart.net/projects/virtuemart/repository/diff/trunk/virtuemart/administrator/components/com_virtuemart/assets/js/vm2admin.js?utf8=%E2%9C%93&rev=8828&rev_to=8670Patch, Vendor Advisory
• https://fortiguard.com/zeroday/FG-VD-15-027Third Party Advisory
• https://virtuemart.net/news/470-release-vm3-0-8-2-secured-by-fortinet-s-fortiguard-labsPatch, Vendor Advisory
• http://dev.virtuemart.net/projects/virtuemart/repository/diff/trunk/virtuemart/administrator/components/com_virtuemart/assets/js/vm2admin.js?utf8=%E2%9C%93&rev=8828&rev_to=8670Patch, Vendor Advisory
• https://fortiguard.com/zeroday/FG-VD-15-027Third Party Advisory
• https://virtuemart.net/news/470-release-vm3-0-8-2-secured-by-fortinet-s-fortiguard-labsPatch, Vendor Advisory

Published

Feb 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3613A vulnerability exists in in FortiManager 5.2.1 and earlier …9.8
• CVE-2015-3614Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.…
• CVE-2015-3615Cross-site scripting (XSS) vulnerability in Fortinet FortiMa…
• CVE-2015-3616SQL injection vulnerability in Fortinet FortiManager 5.0.x b…
• CVE-2015-3617Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2…
• CVE-2015-3618Cross-site scripting (XSS) vulnerability in Nagios Business …
• CVE-2015-3620Cross-site scripting (XSS) vulnerability in the advanced dat…
• CVE-2015-3621Untrusted search path vulnerability in SAP Enterprise Centra…
• CVE-2015-3622The _asn1_extract_der_octet function in lib/decoding.c in GN…
• CVE-2015-3623XML external entity (XXE) vulnerability in QlikTech Qlikview…
• CVE-2015-3624Cross-site request forgery (CSRF) vulnerability in Test/Work…
• CVE-2015-3625The NVIDIA GPU driver for FreeBSD R352 before 352.09, 346 be…