Skip to content
OpenAdvisories

Vendor

Joomla! Project

140 known vulnerabilities.

Products

Joomla! CMS 137 Joomla! Framework Filter package 4 Joomla! Framework 1 joomla/filter 1 joomla/input 1 Joomla! Framework Filesystem package 1 joomla/archive 1 joomla/filesystem 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-90907 Public exploit

    Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

    Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites wit…

    Joomla! Project Joomla! CMS Web / CMS
  • High 8.9
    CVE-2026-73373 Public exploit

    Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

    Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

    Joomla! Project Joomla! CMS Joomla! Framework Filesystem package Web / CMS
  • High 8.6
    CVE-2026-35223 Public exploit EPSS 13%

    Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints

    An improper access check allows unauthorized access to com_config webservice endpoints.

    Joomla! Project Joomla! CMS Web / CMS
  • High 7.5
    CVE-2025-25227 Public exploit

    [20250402] - Joomla Core - MFA Authentication Bypass

    Insufficient state checks lead to a vector that allows to bypass 2FA checks.

    Joomla! Project Joomla! CMS joomla/joomla-cms Web / CMS Packagist
  • Unscored —
    CVE-2023-40626 Public exploit

    [20231101] - Core - Exposure of environment variables

    The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.

    Joomla! Project Joomla! CMS Web / CMS
  • Medium 5.3
    CVE-2023-23752 Exploited Public exploit Scanner template EPSS 100%

    [20230201] - Core - Improper access check in webservice endpoints

    An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

    Joomla! Project Joomla! CMS Web / CMS
    KEV Jan 8, 2024
  • Unscored —
    CVE-2022-27913 Public exploit

    [20221002] - Core - RXSS through reflection of user input in headings

    An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.

    Joomla! Project Joomla! CMS Web / CMS
  • Unscored —
    CVE-2021-23132 Public exploit

    [20210306] - Core - com_media allowed paths that are not intended for image uploads

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

    Joomla! Project Joomla! CMS Web / CMS