Skip to content
OpenAdvisories
High WID-SEC-2026-0936 6 CVEs

Joomla CMS: Mehrere Schwachstellen

Published Mar 31, 2026 · Updated Apr 1, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Joomla CMS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, SQL-Injection-Angriffe durchzuführen, Daten zu manipulieren oder Cross-Site-Scripting-Angriffe auszuführen.

Product

Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 6

  • High 8.6
    CVE-2026-23898

    Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate

    Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

    Joomla! Project Joomla! CMS Web / CMS
  • High 8.6
    CVE-2026-23899

    Joomla! Core - [20260306] - Improper access check in webservice endpoints

    An improper access check allows unauthorized access to webservice endpoints.

    Joomla! Project Joomla! CMS Web / CMS
  • Medium 6.9
    CVE-2026-21630

    Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint

    Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

    Joomla! Project Joomla! CMS Web / CMS
  • Medium 6.3
    CVE-2026-21629

    Joomla! Core - [20260301] - ACL hardening in com_ajax

    The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

    Joomla! Project Joomla! CMS Web / CMS
  • Medium 5.9
    CVE-2026-21631

    Joomla! Core - [20260303] - XSS vector in com_associations comparison view

    Lack of output escaping leads to a XSS vector in the multilingual associations component.

    Joomla! Project Joomla! CMS Web / CMS
  • Medium 5.9
    CVE-2026-21632

    Joomla! Core - [20260304] - XSS vectors in various article title outputs

    Lack of output escaping for article titles leads to XSS vectors in various locations.

    Joomla! Project Joomla! CMS Web / CMS

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-17855, EUVD-2026-17861, EUVD-2026-17853, EUVD-2026-17863, EUVD-2026-17857, EUVD-2026-17859

  2. #1

    Initiale Fassung

References