published December 16, 2015
NVD has not assigned a CVSS score to this record. It sits in the 99.9th percentile for exploit probability.
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.