Description
Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to the default URI.
Exploits (1)
exploitdb
WORKING POC
by High-Tech Bridge SA · textwebappsphp
https://www.exploit-db.com/exploits/31174
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/64659
Various Sources x_refsource_confirm
http://stackideas.com/downloads/changelog/komento
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/530873/100/0/threaded
Exploit x_refsource_misc
https://www.htbridge.com/advisory/HTB23194
Exploit exploit
x_refsource_exploit-db
http://www.exploit-db.com/exploits/31174
Scores
EPSS
0.0073
EPSS Percentile
72.9%
Details
CWE
CWE-79
Status
published
Products (3)
stackideas/komento
1.7.0
stackideas/komento
1.7.1
stackideas/komento
< 1.7.2
Published
Jan 30, 2014
Tracked Since
Feb 18, 2026