Description
An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen.
Remediation
References
Related Vulnerabilities
WordPress Plugin Galleries by Angie Makes Cross-Site Scripting (1.67)
WebLogic URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2026-35302)
WordPress Plugin Simple Membership Cross-Site Request Forgery (3.8.4)
Python Integer Overflow or Wraparound Vulnerability (CVE-2018-20406)