Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in Joomla ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsmechanismen zu umgehen.
Product
Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Vulnerabilities 12
-
Medium 6.4
Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints
An improper access check allows privileged users to overwrite media files without editing permissions.
-
Medium 6.4
Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
-
Medium 6.4
Joomla! Core - [20260709] - Incorrect Access Control in com_workflow
An improper access check allows unauthorized users to access workflow stage and transition information.
-
Medium 6.4
Joomla! Core - [20260710] - Incorrect Access Control in com_modules
An improper access check allows users to display a list of modules in the frontend.
-
Medium 6.4
Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access com_privacy datasets.
-
Medium 6.4
Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints
An improper access check allows unauthorized users to create custom fields via webservices endpoints.
-
Medium 5.9
Joomla! Core - [20260703] - XSS in MFA method management
Lack of validation leads to an XSS vulnerability in the MFA management views.
-
Medium 5.9
Joomla! Core - [20260704] - XSS in com_templates
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
-
Medium 5.9
Joomla! Core - [20260705] - XSS in various modalreturn layouts
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
-
Medium 5.9
Joomla! Core - [20260706] - XSS in com_installer
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
-
Medium 5.9
Joomla! Core - [20260707] - XSS in the generic image output layout
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
-
Medium 5.9
Joomla! Core - [20260708] - XSS through language overrides
Improper validation leads to a generic XSS vector in the language override feature.
Revision history
-
#1
Initiale Fassung
References
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1057-20260703-core-xss-in-mfa-method-management.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1058-20260704-core-xss-in-com-templates.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1059-20260705-core-xss-in-various-modalreturn-layouts.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1060-20260706-core-xss-in-com-installer.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1061-20260707-core-xss-in-the-generic-image-output-layout.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1062-20260708-core-xss-through-language-overrides.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1063-20260709-core-incorrect-access-control-in-com-workflow.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1064-20260710-core-incorrect-access-control-in-com-modules.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1065-20260711-core-incorrect-access-control-in-com-privacy-webservice-endpoints.html
-
Joomla Security Announcements vom 2026-07-07
https://developer.joomla.org/security-centre/1066-20260712-core-incorrect-access-control-in-com-fields-webservice-endpoints.html