CVE-2026-48904 Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints

An improper access check allows privelege escalation through the comusers group editing webservice endpoint...

EUVD-2026-31873

An improper access check allows privilege escalation through the comusers batch task...

CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task

An improper access check allows privilege escalation through the comusers batch task...

CVE-2026-48898

An improper access check allows privilege escalation through the comusers batch task...

CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task

An improper access check allows privilege escalation through the comusers batch task...

Joomla! CMS 访问控制错误漏洞

Joomla! CMS is a content management system developed under the open source Joomla! framework. The Joomla! CMS has a vulnerability related to access control. This vulnerability arises from improper access checks, allowing unauthorized users to elevate their privileges by editing Web service...

Joomla! CMS 访问控制错误漏洞

Joomla! CMS is a content management system developed under the open source Joomla! framework. The Joomla! CMS has a vulnerability related to access control, which stems from improper access checks. This vulnerability allows for privilege escalation through the comusers batch task...

Joomla! CMS 跨站请求伪造漏洞

Joomla! CMS is a content management system developed under the open source Joomla! framework. Joomla! CMS has a cross-site request forgeing vulnerability, which stems from the lack of CSRF token validation. This vulnerability may lead to cross-site request forgeing attacks at the comusers...

[20260513] - Core - Privilege escalation through com_users batch task

An improper access check allows privlege escalation through the comusers batch task...

[20260514] - Core - Privilege escalation through com_users webservice endpoints

An improper access check allows privelege escalation through the comusers group editing webservice endpoint...

CVE-2019-10946

An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of comusers lacks access checks, allowing calls from unauthenticated users...

Joomla! 2.5.x < 3.9.17 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.17. It is, therefore, affected by multiple vulnerabilities : - Incorrect ACL checks in the access level section of comusers allow the unauthorized deletion of usergroups...

Code injection

An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of comusers allow the unauthorized editing of usergroups...

PT-2020-12924 · Open Source Matters · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.17 Description: An issue was discovered that allows unauthorized editing of usergroups due to incorrect ACL checks in the access level section of com users. Recommendations: For versions prior to 3.9.17, update t...

[20200403] - Core - Incorrect access control in com_users access level deletion function

Incorrect ACL checks in the access level section of comusers allow the unauthorized deletion of usergroups...

[20200401] - Core - Incorrect access control in com_users access level editing function

Incorrect ACL checks in the access level section of comusers allow the unauthorized editing of usergroups...

Joomla! < 3.9.6 XSS Vulnerability

This VT has been deprecated due to the CVE already being covered by another script SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Joomla! 1.7.0 <= 3.9.5 XSS Vulnerability

Joomla! is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-11809

An issue was discovered in Joomla! before 3.9.6. The debug views of comusers do not properly escape user supplied data, which leads to a potential XSS attack vector...

CVE-2019-11809

Joomla! before 3.9.6 contains an XSS vulnerability in the debug views of com_users due to improper escaping of user-supplied data. Affects Joomla! versions prior to 3.9.6; exploitation details are not specified in the provided documents. Remediation is a vendor fix: upgrade to 3.9.6 or later.