CVE-2015-7324

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-12-27 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment.

Affected products

Stackideas Komento: before 2.0.5 — fixed in 2.0.5

How to fix

Upgrade to a fixed version: Stackideas Komento 2.0.5. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2015/Oct/11
https://stackideas.com/changelog/komento?version=2.0.5
https://www.davidsopas.com/komento-joomla-component-persistent-xss/
http://seclists.org/fulldisclosure/2015/Oct/11
https://stackideas.com/changelog/komento?version=2.0.5
https://www.davidsopas.com/komento-joomla-component-persistent-xss/

Get alerted when CVE-2015-7324 or the next vulnerability affects your stack