CVE-2019-17527

CRITICAL

JS JOBS FREE < 1.2.7 - SQL Injection via Custom Fields Child Parameter

Title source: llm

Description

dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter.

References (1)

Core 1

Core References

Patch, Third Party Advisory x_refsource_misc

https://gist.github.com/blackcon/c61771eb8c9f0aeef6f6797f945efa13

Scores

CVSS v3 9.8

EPSS 0.0103

EPSS Percentile 60.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

joomsky/js_jobs < 1.2.7

Published Dec 19, 2019

Tracked Since Feb 18, 2026