Joomla!
by Joomla
Source repositories
CVEs (418)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-48953 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | ||
| CVE-2026-48952 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | ||
| CVE-2026-48951 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | ||
| CVE-2026-48950 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | ||
| CVE-2026-48949 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of validation leads to an XSS vulnerability in the MFA management views. | ||
| CVE-2026-48948 | Hig | 0.00 | 8.8 | 0.00 | Jul 7, 2026 | An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. | ||
| CVE-2026-48947 | Med | 0.00 | 4.9 | 0.00 | Jul 7, 2026 | An improper access check allows privileged users to overwrite media files without editing permissions. | ||
| CVE-2015-8565 | 0.00 | — | 0.03 | Dec 16, 2015 | Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors. | |||
| CVE-2015-8564 | 0.00 | — | 0.03 | Dec 16, 2015 | Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive. | |||
| CVE-2015-8563 | 0.00 | — | 0.01 | Dec 16, 2015 | Cross-site request forgery (CSRF) vulnerability in the com_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. | |||
| CVE-2015-7899 | 0.00 | — | 0.02 | Oct 29, 2015 | The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors. | |||
| CVE-2015-7859 | 0.00 | — | 0.02 | Oct 29, 2015 | The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors. | |||
| CVE-2015-6939 | 0.00 | — | 0.03 | Sep 18, 2015 | Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2015-5397 | 0.00 | — | 0.01 | Jul 14, 2015 | Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload code via unknown vectors. | |||
| CVE-2015-4654 | 0.00 | — | 0.01 | Jun 18, 2015 | SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent. | |||
| CVE-2012-2413 | 0.00 | — | 0.01 | Oct 20, 2014 | Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php. | |||
| CVE-2014-7984 | 0.00 | — | 0.02 | Oct 8, 2014 | Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication. | |||
| CVE-2014-7983 | 0.00 | — | 0.01 | Oct 8, 2014 | Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2014-7982 | 0.00 | — | 0.01 | Oct 8, 2014 | Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||
| CVE-2014-7229 | 0.00 | — | 0.01 | Oct 8, 2014 | Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial of service via unspecified vectors. |
- risk 0.00cvss 6.1epss 0.00
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
- risk 0.00cvss 6.1epss 0.00
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
- risk 0.00cvss 6.1epss 0.00
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
- risk 0.00cvss 6.1epss 0.00
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
- risk 0.00cvss 6.1epss 0.00
Lack of validation leads to an XSS vulnerability in the MFA management views.
- risk 0.00cvss 8.8epss 0.00
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
- risk 0.00cvss 4.9epss 0.00
An improper access check allows privileged users to overwrite media files without editing permissions.
- CVE-2015-8565Dec 16, 2015risk 0.00cvss —epss 0.03
Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
- CVE-2015-8564Dec 16, 2015risk 0.00cvss —epss 0.03
Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.
- CVE-2015-8563Dec 16, 2015risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the com_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
- CVE-2015-7899Oct 29, 2015risk 0.00cvss —epss 0.02
The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
- CVE-2015-7859Oct 29, 2015risk 0.00cvss —epss 0.02
The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
- CVE-2015-6939Sep 18, 2015risk 0.00cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2015-5397Jul 14, 2015risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload code via unknown vectors.
- CVE-2015-4654Jun 18, 2015risk 0.00cvss —epss 0.01
SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.
- CVE-2012-2413Oct 20, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.
- CVE-2014-7984Oct 8, 2014risk 0.00cvss —epss 0.02
Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.
- CVE-2014-7983Oct 8, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2014-7982Oct 8, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVE-2014-7229Oct 8, 2014risk 0.00cvss —epss 0.01
Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial of service via unspecified vectors.
Page 15 of 21