Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.
CVSS Score
9.8
EPSS Score
0.034
Published
2020-02-25
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
CVSS Score
5.4
EPSS Score
0.014
Published
2019-08-16