CVE-2015-8566
Joomla! Framework Remote Code Injection Vulnerability
CVE-2015-8566 is a high vulnerability (CVSS 7.5) in Joomla Session, published December 16, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.46%, the 95th percentile. Fixed in joomla/session 1.3.1.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 8.46%EPSS, 95th percentile
- Exploitation
- None known1 public exploit
- Fixed in
1.3.1joomla/session +1 more
Description
The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
joomla/sessionPackagist | before 1.3.1 | 1.3.1 |
joomla/sessionPackagist | before 1.3.1, plus listed versions 1.01.0-alpha1.0-beta1.0-beta21.0-beta3 Show 6 moreShow less1.1.01.2.01.2.11.2.21.2.31.3.0 | 1.3.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Joomla! 1.5 < 3.4.6 - Object Injection 'x-forwarded-for' Header Remote Code Execution | 2015-12-18 |
What each source reports
NVD Score used
The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
- Record
CVE-2015-8566- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
- Record
CVE-2015-8566- Updated
- 2026-11-02
EUVDEUVD-2022-5653No score
The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
- Record
EUVD-2022-5653- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wwfh-28hx-w2r2No score
Joomla! Framework Remote Code Injection Vulnerability
The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
- Record
GHSA-wwfh-28hx-w2r2- Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGHSA-wwfh-28hx-w2r2No score
Joomla! Framework Remote Code Injection Vulnerability
The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
- Record
GHSA-wwfh-28hx-w2r2- Weakness
- CWE-74
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/79197
developer.joomla.org/security-centre/637-20151205-session-remote-code-execution-vulnerability.html
nvd.nist.gov/vuln/detail/CVE-2015-8566
github.com/FriendsOfPHP/security-advisories/blob/master/joomla/session/CVE-2015-8566.yaml
web.archive.org/web/20160603093633/http://www.securityfocus.com/bid/79197