Joomla!
by Joomla
Source repositories
CVEs (418)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-30894 | Med | 0.40 | 6.1 | 0.00 | May 26, 2026 | Lack of output escaping leads to a XSS vector in the content history component. | ||
| CVE-2026-25901 | Med | 0.40 | 6.1 | 0.00 | May 26, 2026 | Lack of output escaping leads to a XSS vector in the multilingual associations component. | ||
| CVE-2026-25900 | Med | 0.40 | 6.1 | 0.00 | May 26, 2026 | Lack of output escaping leads to a XSS vector in the feed modules. | ||
| CVE-2026-23898 | Hig | 0.40 | 7.2 | 0.00 | Apr 1, 2026 | Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism. | ||
| CVE-2026-21629 | Hig | 0.40 | 7.3 | 0.00 | Apr 1, 2026 | The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers. | ||
| CVE-2025-63083 | Med | 0.40 | 6.1 | 0.00 | Jan 6, 2026 | Lack of output escaping leads to a XSS vector in the pagebreak plugin. | ||
| CVE-2025-63082 | Med | 0.40 | 6.1 | 0.00 | Jan 6, 2026 | Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. | ||
| CVE-2024-40743 | Med | 0.40 | 6.1 | 0.00 | Aug 20, 2024 | The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. | ||
| CVE-2024-27186 | Med | 0.40 | 6.1 | 0.00 | Aug 20, 2024 | The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | ||
| CVE-2024-27184 | Med | 0.40 | 6.1 | 0.00 | Aug 20, 2024 | Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. | ||
| CVE-2024-26279 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | The wrapper extensions do not correctly validate inputs, leading to XSS vectors. | ||
| CVE-2024-26278 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | The Custom Fields component not correctly filter inputs, leading to a XSS vector. | ||
| CVE-2024-21731 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. | ||
| CVE-2024-21729 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field. | ||
| CVE-2024-21724 | Med | 0.40 | 6.1 | 0.01 | Feb 29, 2024 | Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions. | ||
| CVE-2023-23754 | Med | 0.40 | 6.1 | 0.00 | May 30, 2023 | An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen. | ||
| CVE-2022-27914 | Med | 0.40 | 6.1 | 0.00 | Nov 8, 2022 | An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media. | ||
| CVE-2022-27913 | Med | 0.40 | 6.1 | 0.00 | Oct 25, 2022 | An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components. | ||
| CVE-2022-23801 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media. | ||
| CVE-2022-23800 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components. |
- risk 0.40cvss 6.1epss 0.00
Lack of output escaping leads to a XSS vector in the content history component.
- risk 0.40cvss 6.1epss 0.00
Lack of output escaping leads to a XSS vector in the multilingual associations component.
- risk 0.40cvss 6.1epss 0.00
Lack of output escaping leads to a XSS vector in the feed modules.
- risk 0.40cvss 7.2epss 0.00
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
- risk 0.40cvss 7.3epss 0.00
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
- risk 0.40cvss 6.1epss 0.00
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
- risk 0.40cvss 6.1epss 0.00
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
- risk 0.40cvss 6.1epss 0.00
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
- risk 0.40cvss 6.1epss 0.00
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
- risk 0.40cvss 6.1epss 0.00
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..
- risk 0.40cvss 6.1epss 0.00
The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
- risk 0.40cvss 6.1epss 0.00
The Custom Fields component not correctly filter inputs, leading to a XSS vector.
- risk 0.40cvss 6.1epss 0.00
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.
- risk 0.40cvss 6.1epss 0.00
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
- risk 0.40cvss 6.1epss 0.01
Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.
Page 7 of 21