Kunena is a forum and community platform component for Joomla that, despite modest disclosure volume, occupies a niche in web-based collaboration and discussion deployments. Vulnerabilities affecting the vendor skew toward serious outcomes and frequently acquire public exploit code, clustering around web-application input handling and file-upload weaknesses—specifically cross-site scripting, SQL injection, and unrestricted file uploads—that are characteristic of server-side forum software. Live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Kunena over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-11020CRITICAL Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution. | Feb 25, 2020 | 9.8 | 30 | NO | NO |
CVE-2009-4550HIGH SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter | Jan 4, 2010 | 7.5 | 28 | NO | YES |
CVE-2012-4868HIGH SQL injection vulnerability in news.php in the Kunena component 1.7.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter. | Sep 6, 2012 | 7.5 | 23 | NO | NO |
CVE-2017-5673MEDIUM In the Kunena extension 5.0.2 through 5.0.4 for Joomla!, the forum message subject (aka topic subject) accepts JavaScript, leading to XSS. Six files are affected: crypsis/layouts/m | Mar 22, 2017 | 6.1 | 22 | NO | NO |
CVE-2019-15120MEDIUM The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode. | Aug 16, 2019 | 5.4 | 20 | NO | NO |
CVE-2014-9102MEDIUM Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an | Nov 26, 2014 | 6.5 | 18 | NO | NO |
CVE-2014-9103MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) index | Nov 26, 2014 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Kunena.
Media articles that mention a CVE ID that affects a product developed by Kunena — matched by CVE ID, not by vendor name.