Aria Akhavan

**Name of the Vulnerable Software and Affected Versions** Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 **Description** Lack of escaping in the generic audio and video output layouts leads to a Cross-Site Scripting (XSS) issue. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Joomla! Core versions 4.0.0 through 5.4.8 to a version newer than 5.4.8. Update Joomla! Core versions 6.0.0 through 6.1.3 to a version newer than 6.1.3.

**Name of the Vulnerable Software and Affected Versions** Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 **Description** Improper validation of the cache group name allows path traversal within the file storage of the caching layer. This flaw enables the arbitrary deletion of directories via the cache purge action. **Recommendations** Update Joomla! Core versions 4.0.0 through 5.4.8 to a version newer than 5.4.8. Update Joomla! Core versions 6.0.0 through 6.1.3 to a version newer than 6.1.3.

**Name of the Vulnerable Software and Affected Versions** Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 **Description** Various core extensions contain Server-Side Request Forgery (SSRF) vectors. This occurs because URLs used for server-side requests are improperly validated, allowing an attacker to induce the server to make requests to unintended destinations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.