UpHeron
All vulnerabilities

Servers and applications

CVE-2019-14654

In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

Severity
High 8.8
Published
5 Aug 2019
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Joomla!Servers and applications · cpe:a:joomla:joomla\!
  • Version 3.9.7-rc
  • Version 3.9.7
  • Version 3.9.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-14654
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-14654