Vendor
Joomla! Project
150 known vulnerabilities.
Products
150 results · Feed
-
High 8.2
Joomla! Core - [20260511] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
-
Medium 4.6
Joomla! Core - [20260505] - CSRF in user activation endpoint
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
-
High 7.5CVE-2026-40383 EPSS 13%
Joomla! Core - [20260509] - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
-
Medium 6.9
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
-
Medium 5.9
Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
-
Medium 6.9
Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
Lack of input filtering leads to an XSS vector in the HTML filter code.
-
High 8.2
Joomla! Core - [20260512] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
-
Medium 6.9
Joomla! Core - [20260502] - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component.
-
Medium 5.3
Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
An improper access check allows privilege escalation through the com_users batch task.
-
Medium 6.4
Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
-
Critical 9.8
Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
-
High 8.6
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to com_config webservice endpoints.
-
Medium 6.9
Joomla! Core - [20260501] - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules.
-
High 8.2
Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
-
Medium 6.9
Joomla! Core - [20260504] - XSS in readmore links
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
-
High 8.2
Joomla! Core - [20260513] - Privilege escalation through com_users batch task
An improper access check allows privilege escalation through the com_users batch task.
-
Medium 6.9
Joomla! Core - [20260503] - XSS in com_contenthistory
Lack of output escaping leads to a XSS vector in the content history component.
-
High 7.5
Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
-
Medium 6.9
Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
-
High 8.6
Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
-
Medium 6.3
Joomla! Core - [20260301] - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
-
High 8.6
Joomla! Core - [20260306] - Improper access check in webservice endpoints
An improper access check allows unauthorized access to webservice endpoints.
-
Medium 5.9
Joomla! Core - [20260303] - XSS vector in com_associations comparison view
Lack of output escaping leads to a XSS vector in the multilingual associations component.
-
Medium 5.9
Joomla! Core - [20260304] - XSS vectors in various article title outputs
Lack of output escaping for article titles leads to XSS vectors in various locations.
-
Medium 5.9
Joomla! Core - [20260101] - Inadequate content filtering for data URLs
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
-
Medium 5.9
Joomla! Core - [20260102] - XSS vector in the pagebreak plugin
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
-
Medium 5.3
Joomla! Core - [20250902] User-Enumeration in passkey authentication method
Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.
-
Medium 4.8
Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code
Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.
-
Critical 9.8
[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and …
-
High 7.5CVE-2025-25227 Public exploit
[20250402] - Joomla Core - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
-
High 7.1
[20250301] - Core - Malicious file uploads via Media Manager
Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.
-
Medium 6.7
[20250201] - Core - SQL injection vulnerability in Scheduled Tasks component
Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.
-
High 7.5
[20250103] - Core - Read ACL violation in multiple core views
Improper Access Controls allows access to protected views.
-
Medium 6.1
[20250101] - Core - XSS vectors in module chromes
Various module chromes didn't properly process inputs, leading to XSS vectors.
-
High 7.5
[20250102] - Core - XSS vector in the id attribute of menu lists
Lack of output escaping in the id attribute of menu lists.
-
Critical 9.1
[20240802] - Core - Cache Poisoning in Pagination
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
-
Medium 6.1
[20240803] - Core - XSS in HTML Mail Templates
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
-
Medium 6.1
[20240801] - Core - Inadequate validation of internal URLs
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..
-
Medium 6.1
[20240805] - Core - XSS vectors in Outputfilter::strip* methods
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
-
High 7.5
[20240804] - Core - Improper ACL for backend profile view
Improper Access Controls allows backend users to overwrite their username when disallowed.