Skip to content
OpenAdvisories

Vendor

Joomla! Project

150 known vulnerabilities.

Products

Joomla! CMS 137 Joomla! 6 Joomla! Framework Filter package 4 Joomla! core 2 Joomla! Framework 1 joomla/filter 1 TinyBrowser Plugin 1 Tiny browser included with TinyMCE 3.0 1 joomla/input 1 Joomla! Framework Filesystem package 1 joomla/archive 1 joomla/filesystem 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-48902

    Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

    The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

    Joomla! Project Joomla! CMS Web / CMS
  • Critical 9.8
    CVE-2025-25226

    [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package

    Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and …

    Joomla! Project Joomla! Framework joomla/database Web / CMS Packagist
  • Critical 9.1
    CVE-2024-27185

    [20240802] - Core - Cache Poisoning in Pagination

    The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.

    Joomla! Project Joomla! CMS Web / CMS
  • Critical 9.8
    CVE-2022-23799

    [20220307] - Core - Variable Tampering on JInput $_REQUEST data

    An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.

    Joomla! Project Joomla! CMS joomla/input joomla/input Web / CMS Packagist