Joomla! (Joomla) - vulnerabilities (CVEs)

340 CVEs, 16 in the last 30 days, 711 known versions, newest CVE from 2026-09-29. Vendor: Joomla.

CVEs of Joomla!

• CVE-2026-90915 - CVSS 7 (high), 2026-09-29: Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache…
• CVE-2026-92226 - CVSS 7 (high), 2026-09-29: Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows…
• CVE-2026-92224 - CVSS 6.7 (medium), 2026-09-29: Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs,…
• CVE-2026-90907 - CVSS 6.9 (medium), 2026-09-29: Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save…
• CVE-2026-90914 - CVSS 6.4 (medium), 2026-09-29: Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability…
• CVE-2026-92231 - CVSS 7.1 (high), 2026-09-29: Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute…
• CVE-2026-90918 - CVSS 6.9 (medium), 2026-09-29: Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism,…
• CVE-2026-92222 - CVSS 8.9 (high), 2026-09-29: Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were…
• CVE-2026-92223 - CVSS 5.1 (medium), 2026-09-29: Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows…
• CVE-2026-90917 - CVSS 6.9 (medium), 2026-09-29: Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows…
• CVE-2026-92225 - CVSS 6.7 (medium), 2026-09-29: Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied…
• CVE-2026-92227 - CVSS 8.2 (high), 2026-09-29: Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an…
• CVE-2026-92232 - CVSS 7.1 (high), 2026-09-29: Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The…
• CVE-2026-90916 - CVSS 5.1 (medium), 2026-09-29: Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows…
• CVE-2026-90913 - CVSS 7 (high), 2026-09-29: Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check…
• CVE-2026-90906 - CVSS 8.3 (high), 2026-09-29: Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link…
• CVE-2026-71573 - CVSS 8.3 (high), 2026-08-18: Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins…
• CVE-2026-72531 - CVSS 5.4 (medium), 2026-08-18: Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows…
• CVE-2026-73336 - CVSS 6.4 (medium), 2026-08-18: Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org…
• CVE-2026-73372 - CVSS 5.1 (medium), 2026-08-18: Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check…
• CVE-2026-71572 - CVSS 5.4 (medium), 2026-08-18: Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header…
• CVE-2026-73337 - CVSS 8.2 (high), 2026-08-18: Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass…
• CVE-2026-73371 - CVSS 5.1 (medium), 2026-08-18: Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users…
• CVE-2026-72532 - CVSS 5.4 (medium), 2026-08-18: Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows…
• CVE-2026-73373 - CVSS 9.8 (critical), 2026-08-18: Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML…
• CVE-2026-71574 - CVSS 8.5 (high), 2026-08-18: Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows…
• CVE-2026-48952 - CVSS 6.1 (medium), 2026-07-07: Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
• CVE-2026-48947 - CVSS 6.4 (medium), 2026-07-07: An improper access check allows privileged users to overwrite media files without editing permissions.
• CVE-2026-48958 - CVSS 8.8 (high), 2026-07-07: An improper access check allows unauthorized users to create custom fields via webservices endpoints.
• CVE-2026-48950 - CVSS 6.1 (medium), 2026-07-07: Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
• CVE-2026-48955 - CVSS 6.5 (medium), 2026-07-07: An improper access check allows unauthorized users to access workflow stage and transition information.
• CVE-2026-48956 - CVSS 6.4 (medium), 2026-07-07: An improper access check allows users to display a list of modules in the frontend.
• CVE-2026-48957 - CVSS 8.8 (high), 2026-07-07: An improper access check allows unauthorized users to access com_privacy datasets.
• CVE-2026-48951 - CVSS 6.1 (medium), 2026-07-07: Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
• CVE-2026-48953 - CVSS 6.1 (medium), 2026-07-07: Lack of escaping leads to an XSS vulnerability in the generic image output layout.
• CVE-2026-48948 - CVSS 8.8 (high), 2026-07-07: An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
• CVE-2026-48949 - CVSS 6.1 (medium), 2026-07-07: Lack of validation leads to an XSS vulnerability in the MFA management views.
• CVE-2026-48954 - CVSS 6.1 (medium), 2026-07-07: Improper validation leads to a generic XSS vector in the language override feature.
• CVE-2026-48903 - CVSS 6.9 (medium), 2026-05-26: Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
• CVE-2026-48905 - CVSS 6.9 (medium), 2026-05-26: Lack of input filtering leads to an XSS vector in the HTML filter code.
• CVE-2026-48904 - CVSS 9.8 (critical), 2026-05-26: An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
• CVE-2026-48897 - CVSS 8.2 (high), 2026-05-26: Insufficient state checks lead to a vector that allows to bypass 2FA checks.
• CVE-2026-48900 - CVSS 6.4 (medium), 2026-05-26: An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
• CVE-2026-48896 - CVSS 8.2 (high), 2026-05-26: Insufficient state checks lead to a vector that allows to bypass 2FA checks.
• CVE-2026-48899 - CVSS 9.8 (critical), 2026-05-26: An improper access check allows privilege escalation through the com_users batch task.
• CVE-2026-48902 - CVSS 9.8 (critical), 2026-05-26: The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
• CVE-2026-48898 - CVSS 9.8 (critical), 2026-05-26: An improper access check allows privilege escalation through the com_users batch task.
• CVE-2026-48901 - CVSS 7.5 (high), 2026-05-26: The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
• CVE-2026-40383 - CVSS 9.8 (critical), 2026-05-26: An improper validation of user-supplied input leads to a local file inclusion vulnerability.
• CVE-2026-40384 - CVSS 7.5 (high), 2026-05-26: An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
• CVE-2026-35223 - CVSS 9.8 (critical), 2026-05-26: An improper access check allows unauthorized access to com_config webservice endpoints.
• CVE-2026-35220 - CVSS 4.6 (medium), 2026-05-26: Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
• CVE-2026-35222 - CVSS 9.8 (critical), 2026-05-26: Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
• CVE-2026-35221 - CVSS 9.8 (critical), 2026-05-26: Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
• CVE-2026-30895 - CVSS 6.9 (medium), 2026-05-26: Lack of output escaping leads to a XSS vector in the readmore links for com_content.
• CVE-2026-25901 - CVSS 6.9 (medium), 2026-05-26: Lack of output escaping leads to a XSS vector in the multilingual associations component.
• CVE-2026-25900 - CVSS 6.9 (medium), 2026-05-26: Lack of output escaping leads to a XSS vector in the feed modules.
• CVE-2026-30894 - CVSS 6.9 (medium), 2026-05-26: Lack of output escaping leads to a XSS vector in the content history component.
• CVE-2026-23898 - CVSS 8.6 (high), 2026-04-01: Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
• CVE-2026-21632 - CVSS 5.9 (medium), 2026-04-01: Lack of output escaping for article titles leads to XSS vectors in various locations.
• CVE-2026-21631 - CVSS 5.9 (medium), 2026-04-01: Lack of output escaping leads to a XSS vector in the multilingual associations component.
• CVE-2026-23899 - CVSS 8.8 (high), 2026-04-01: An improper access check allows unauthorized access to webservice endpoints.
• CVE-2026-21630 - CVSS 8.8 (high), 2026-04-01: Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
• CVE-2026-21629 - CVSS 7.3 (high), 2026-04-01: The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party…
• CVE-2025-63082 - CVSS 6.1 (medium), 2026-01-06: Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
• CVE-2025-63083 - CVSS 6.1 (medium), 2026-01-06: Lack of output escaping leads to a XSS vector in the pagebreak plugin.
• CVE-2025-25227 - CVSS 7.5 (high), 2025-04-08: Insufficient state checks lead to a vector that allows to bypass 2FA checks.
• CVE-2025-25226 - CVSS 9.8 (critical), 2025-04-08: Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is…
• CVE-2024-40749 - CVSS 7.5 (high), 2025-01-07: Improper Access Controls allows access to protected views.
• CVE-2024-40748 - CVSS 7.5 (high), 2025-01-07: Lack of output escaping in the id attribute of menu lists.
• CVE-2024-40747 - CVSS 6.1 (medium), 2025-01-07: Various module chromes didn't properly process inputs, leading to XSS vectors.
• CVE-2024-40743 - CVSS 6.1 (medium), 2024-08-20: The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
• CVE-2024-27184 - CVSS 6.1 (medium), 2024-08-20: Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..
• CVE-2024-27187 - CVSS 7.5 (high), 2024-08-20: Improper Access Controls allows backend users to overwrite their username when disallowed.
• CVE-2024-27186 - CVSS 6.1 (medium), 2024-08-20: The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
• CVE-2024-27185 - CVSS 9.1 (critical), 2024-08-20: The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
• CVE-2024-26279 - CVSS 6.1 (medium), 2024-07-09: The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
• CVE-2024-21731 - CVSS 6.1 (medium), 2024-07-09: Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.
• CVE-2024-21730 - CVSS 5.4 (medium), 2024-07-09: The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector.
• CVE-2024-21729 - CVSS 6.1 (medium), 2024-07-09: Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
• CVE-2024-26278 - CVSS 6.1 (medium), 2024-07-09: The Custom Fields component not correctly filter inputs, leading to a XSS vector.
• CVE-2024-21723 - CVSS 4.3 (medium), 2024-02-29: Inadequate parsing of URLs could result into an open redirect.
• CVE-2024-21726 - CVSS 6.5 (medium), 2024-02-29: Inadequate content filtering leads to XSS vulnerabilities in various components.
• CVE-2024-21722 - CVSS 6.3 (medium), 2024-02-29: The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified.
• CVE-2024-21725 - CVSS 6.1 (medium), 2024-02-29: Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components.
• CVE-2024-21724 - CVSS 6.1 (medium), 2024-02-29: Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
• CVE-2023-40626 - CVSS 7.5 (high), 2023-11-29: The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
• CVE-2023-23755 - CVSS 7.5 (high), 2023-05-30: An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods.
• CVE-2023-23754 - CVSS 6.1 (medium), 2023-05-30: An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.
• CVE-2023-23752 - CVSS 5.3 (medium), 2023-02-16: An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
• CVE-2023-23750 - CVSS 6.3 (medium), 2023-02-01: An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.
• CVE-2023-23751 - CVSS 4.3 (medium), 2023-02-01: An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs.
• CVE-2022-27914 - CVSS 6.1 (medium), 2022-11-08: An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in…
• CVE-2022-27913 - CVSS 6.1 (medium), 2022-10-25: An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in…
• CVE-2022-27912 - CVSS 5.3 (medium), 2022-10-25: An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.
• CVE-2022-27911 - CVSS 5.3 (medium), 2022-08-31: An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.
• CVE-2022-23794 - CVSS 5.3 (medium), 2022-03-30: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings…
• CVE-2022-23797 - CVSS 9.8 (critical), 2022-03-30: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an…
• CVE-2022-23800 - CVSS 6.1 (medium), 2022-03-30: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.
• CVE-2022-23793 - CVSS 7.5 (high), 2022-03-30: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the…