joomla/joomla-cms

8 results · Feed

• High 7.5
  CVE-2025-25227 Public exploit

  [20250402] - Joomla Core - MFA Authentication Bypass

  Insufficient state checks lead to a vector that allows to bypass 2FA checks.

  Joomla! Project Joomla! CMS joomla/joomla-cms Web / CMS Packagist
  Apr 8, 2025
• Medium 6.1
  CVE-2019-16725

  Joomla! XSS in Default Templates

  In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.

  joomla/joomla-cms Packagist
  Sep 24, 2019
• Critical 9.8
  CVE-2019-7743

  Joomla! Object Injection Vulnerability

  An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

  joomla/joomla-cms Packagist
  Feb 12, 2019
• Medium 4.8
  CVE-2018-11326

  Joomla! XSS Vulnerability

  An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attac…

  joomla/joomla-cms Packagist
  May 22, 2018
• Low —
  CVE-2013-5583

  Joomla! Cross-site Scripting vulnerability

  Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  joomla/joomla-cms Packagist
  Dec 29, 2013
• Low —
  CVE-2011-4332

  Joomla! vulnerable to Cross-site Scripting

  Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  joomla/joomla-cms Packagist
  Nov 23, 2011
• Medium —
  CVE-2011-2509

  Joomla! vulnerable to Cross-site Scripting

  Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the quer…

  joomla/joomla-cms Packagist
  Jul 27, 2011
• Medium —
  CVE-2010-1649

  Joomla! vulnerable to Cross-site Scripting

  Multiple cross-site scripting (XSS) vulnerabilities in the back end in Joomla! 1.5 through 1.5.17 allow remote attackers to inject arbitrary web script or HTML via unknown vectors related to "various administrator screens," possibly the search parameter in ad…

  joomla/joomla-cms Packagist
  Jun 7, 2010