Description
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.
Remediation
References
Related Vulnerabilities
WordPress Plugin Google Forms Server-Side Request Forgery (0.91)
WordPress Plugin easyping-website subscriptions done right PHP Object Injection (0.0.1)
e107 Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-11127)
WordPress Plugin SocialGrid 'default_services' Parameter Cross-Site Scripting (2.3)