Vendor
Joomla! Project
150 known vulnerabilities.
Products
150 results · Feed
-
Medium 6.1
[20240701] - Core - XSS in accessible media selection field
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
-
Medium 5.4
[20240702] - Core - Self-XSS in fancyselect list field layout
The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.
-
Medium 6.1
[20240704] - Core - XSS in Wrapper extensions
The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
-
Medium 4.6
[20240705] - Core - XSS in com_fields default field value
The Custom Fields component not correctly filter inputs, leading to a XSS vector.
-
Medium 6.1
[20240703] - Core - XSS in StringHelper::truncate method
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.
-
Medium 4.3
[20240202] - Core - Open redirect in installation application
Inadequate parsing of URLs could result into an open redirect.
-
Medium 6.1CVE-2024-21725 EPSS 27%
[20240204] - Core - XSS in mail address outputs
Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.
-
Medium 6.1
[20240203] - Core - XSS in media selection fields
Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
-
Medium 6.3
[20240201] - Core - Insufficient session expiration in MFA management views
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
-
Medium 6.5CVE-2024-21726 EPSS 49%
[20240205] - Core - Inadequate content filtering within the filter code
Inadequate content filtering leads to XSS vulnerabilities in various components.
-
Unscored —CVE-2023-40626 Public exploit
[20231101] - Core - Exposure of environment variables
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
-
Medium 6.1
[20230501] - Core - Open Redirect and XSS within the mfa select
An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.
-
High 7.5
[20230502] - Core - Bruteforce prevention within the mfa screen
An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.
-
Medium 5.3
[20230201] - Core - Improper access check in webservice endpoints
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
KEV Jan 8, 2024 -
Medium 4.3
[20230102] - Core - Missing ACL checks for com_actionlogs
An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs.
-
Medium 6.3
[20230101] - Core - CSRF within post-installation messages
An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.
-
Unscored —
[20221101] - Core - RXSS through reflection of user input in com_media
An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.
-
Unscored —CVE-2022-27913 Public exploit
[20221002] - Core - RXSS through reflection of user input in headings
An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.
-
Unscored —
[20221001] - Core - Debug Mode leaks full request payloads including passwords
An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.
-
Unscored —
[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'
An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.
-
Unscored —
[20220309] - Core - XSS attack vector through SVG
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.
-
Medium 6.1
[20220308] - Core - Inadequate content filtering within the filter code
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.
-
Critical 9.8
[20220307] - Core - Variable Tampering on JInput $_REQUEST data
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.
-
Unscored —
[20220306] - Core - Inadequate validation of internal URLs
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.
-
Unscored —
[20220305] - Core - Inadequate filtering on the selected Ids
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.
-
Unscored —
[20220304] - Core - Missing input validation within com_fields class inputs
An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.
-
Unscored —
[20220303] - Core - User row are not bound to a authentication mechanism
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.
-
Medium 5.3
[20220302] - Core - Path Disclosure within filesystem error messages
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.
-
High 7.5
[20220301] - Core - Zip Slip within the Tar extractor
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.
-
Unscored —
[20210801] - Core - Insufficient access control for com_media deletion endpoint
An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.
-
Unscored —
[20210705] - Core - XSS in com_media imagelist
An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability.
-
Unscored —
[20210703] - Core - Lack of enforced session termination
An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked.
-
Unscored —
[20210704] - Core - Privilege escalation through com_installer
An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for com_installer is limited to super users already.
-
Unscored —
[20210702] - Core - DoS through usergroup table manipulation
An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table.
-
Unscored —
[20210701] - Core - XSS in JForm Rules field
An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.
-
Unscored —
[20210502] - Core - CSRF in AJAX reordering endpoint
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.
-
Unscored —
[20210503] - Core - CSRF in data download endpoints
An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.
-
Unscored —
[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload
An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.
-
Unscored —
[20210402] - Core - Inadequate filters on module layout settings
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.
-
Unscored —CVE-2021-26030 EPSS 83%
[20210401] - Core - Escape xss in logo parameter error pages
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page