Browse CVEs

HIGH 7.2 CVE-2026-23898 Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism. Joomla\! 5.4.4 / 6.0.4+ Fix from $1,9502026-04-01 MEDIUM 5.4 CVE-2026-21631 Lack of output escaping leads to a XSS vector in the multilingual associations component. Joomla\! 5.4.4 / 6.0.4+ Fix from $1,6002026-04-01 MEDIUM 5.4 CVE-2026-21632 Lack of output escaping for article titles leads to XSS vectors in various locations. Joomla\! 5.4.4 / 6.0.4+ Fix from $1,6002026-04-01 HIGH 8.8 CVE-2026-21630 Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint. Joomla\! 5.4.4 / 6.0.4+ Fix from $1,9502026-04-01 HIGH 7.3 CVE-2026-21629 The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd par… Joomla\! 5.4.4 / 6.0.4+ Fix from $1,9502026-04-01 MEDIUM 6.1 CVE-2025-63082 Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. Joomla\! 5.4.2 / 6.0.2+ Fix from $1,6002026-01-06 MEDIUM 6.1 CVE-2025-63083 Lack of output escaping leads to a XSS vector in the pagebreak plugin. Joomla\! 5.4.2 / 6.0.2+ Fix from $1,6002026-01-06 CRITICAL 9.8 CVE-2025-25226 Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected … Joomla\! 2.2.0 / 3.4.0+ Fix from $2,3002025-04-08 HIGH 7.5 CVE-2025-25227 Insufficient state checks lead to a vector that allows to bypass 2FA checks. Joomla\! 4.4.13 / 5.2.6+ Fix from $1,9502025-04-08 HIGH 7.5 CVE-2024-40748 Lack of output escaping in the id attribute of menu lists. Joomla\! 3.10.20 / 4.4.10+ Fix from $1,9502025-01-07 HIGH 7.5 CVE-2024-40749 Improper Access Controls allows access to protected views. Joomla\! 3.10.20 / 4.4.10+ Fix from $1,9502025-01-07 MEDIUM 6.1 CVE-2024-40747 Various module chromes didn't properly process inputs, leading to XSS vectors. Joomla\! 4.4.10 / 5.2.3+ Fix from $1,6002025-01-07 MEDIUM 6.1 CVE-2024-40743 The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. Joomla\! 3.10.17 / 4.4.6+ Fix from $1,6002024-08-20 CRITICAL 9.1 CVE-2024-27185 The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. Joomla\! 3.10.17 / 4.4.7+ Fix from $2,3002024-08-20 HIGH 7.5 CVE-2024-27187 Improper Access Controls allows backend users to overwrite their username when disallowed. Joomla\! 4.4.7 / 5.1.3+ Fix from $1,9502024-08-20 MEDIUM 6.1 CVE-2024-27184 Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. Joomla\! 3.10.17 / 4.4.7+ Fix from $1,6002024-08-20 MEDIUM 6.1 CVE-2024-27186 The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Joomla\! 4.4.7 / 5.1.3+ Fix from $1,6002024-08-20 MEDIUM 6.1 CVE-2024-26279 The wrapper extensions do not correctly validate inputs, leading to XSS vectors. Joomla\! 3.10.16 / 4.4.6+ Fix from $1,6002024-07-09 MEDIUM 6.1 CVE-2024-21729 Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field. Joomla\! 4.4.6 / 5.1.2+ Fix from $1,6002024-07-09 MEDIUM 6.1 CVE-2024-21731 Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. Joomla\! after 5.1.1 Fix from $1,6002024-07-09 MEDIUM 6.1 CVE-2024-26278 The Custom Fields component not correctly filter inputs, leading to a XSS vector. Joomla\! 3.10.16 / 4.4.6+ Fix from $1,6002024-07-09 MEDIUM 5.4 CVE-2024-21730 The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector. Joomla\! 4.4.6 / 5.1.2+ Fix from $1,6002024-07-09 MEDIUM 6.5 CVE-2024-21726EPSS 49% Inadequate content filtering leads to XSS vulnerabilities in various components. Joomla\! 4.4.3 / 5.0.3+ Fix from $1,6002024-02-29 MEDIUM 6.3 CVE-2024-21722 The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified. Joomla\! 3.10.15 / 4.4.3+ Fix from $1,6002024-02-29 MEDIUM 6.1 CVE-2024-21724 Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions. Joomla\! 3.10.15 / 4.4.3+ Fix from $1,6002024-02-29 MEDIUM 6.1 CVE-2024-21725EPSS 32% Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components. Joomla\! 4.4.3 / 5.0.3+ Fix from $1,6002024-02-29 HIGH 7.5 CVE-2023-40626 The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information. Joomla\! 3.10.14 / 4.4.1+ Fix from $1,9502023-11-29 HIGH 7.5 CVE-2023-23755 An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods. Joomla\! 4.3.2+ Fix from $1,9502023-05-30 MEDIUM 6.1 CVE-2023-23754 An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection s… Joomla\! 4.3.2+ Fix from $1,6002023-05-30 MEDIUM 5.3 CVE-2023-23752 KEVEPSS 100% An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. Joomla\! 4.2.8+ Fix from $1,6002023-02-16