joomsky - MidnightBSD Security Advisories

CVE-2018-20974 MEDIUM

The js-jobs plugin before 1.0.7 for WordPress has CSRF.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2018-21002 MEDIUM

The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2018-5994 HIGH

SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resume request.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
joomsky	js_jobs	1.1.9

CVE-2018-6006 HIGH

SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
joomsky	js_autoz	1.0.9

CVE-2018-6007 MEDIUM

CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
joomsky	js_support_ticket	1.1.0

CVE-2018-9183 LOW

The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
joomsky	js_jobs	*

CVE-2019-17527 HIGH

dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
joomsky	js_jobs	*

CVE-2022-46838

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	3.9	5.2

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2022-46840

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	2.8	2.5

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2022-47151

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	3.9	4.7

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2023-25444

Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.7.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	2.3	6.0

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2023-25963

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L	1.7	3.7

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2023-28689

Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	2.8	3.6

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2023-31087

Cross-Site Request Forgery (CSRF) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2024-43274

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N	3.9	1.4

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2024-51670

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through <= 2.8.7.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L	1.7	3.7

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2025-22206

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	1.2	3.4

Products Affected

Vendor	Product	Version
joomsky	js_jobs	*

CVE-2025-22208

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	1.2	3.4

Products Affected

Vendor	Product	Version
joomsky	js_jobs	*

CVE-2025-22209

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	4.7	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	1.2	3.4

Products Affected

Vendor	Product	Version
joomsky	js_jobs	*

CVE-2025-30878

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	3.9	5.2
audit@patchstack.com	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	3.9	4.0

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2025-30880

Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 2.9.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2025-30882

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through <= 2.9.1.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2025-30886

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows SQL Injection.This issue affects JS Help Desk: from n/a through <= 2.9.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0
audit@patchstack.com	9.3	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L	3.9	4.7

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2025-30901

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through <= 2.9.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9

Products Affected

Vendor	Product	Version
joomsky	js_help_desk	*

CVE-2025-31867

Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	2.8	2.5

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2025-31868

Missing Authorization vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2025-32146

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2025-32626

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Job Manager js-jobs allows SQL Injection.This issue affects JS Job Manager: from n/a through <= 2.0.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9
audit@patchstack.com	9.3	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L	3.9	4.7

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2025-32627

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2025-32660

Unrestricted Upload of File with Dangerous Type vulnerability in JoomSky JS Job Manager js-jobs allows Upload a Web Shell to a Web Server.This issue affects JS Job Manager: from n/a through <= 2.0.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

CVE-2025-58234

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Job Manager js-jobs allows Stored XSS.This issue affects JS Job Manager: from n/a through <= 2.0.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L	2.3	3.7

Products Affected

Vendor	Product	Version
joomsky	js_job_manager	*

Advisories for joomsky