Joomla! CMS 安全漏洞

Joomla! CMS is a content management system developed under the open source Joomla! framework. The Joomla! CMS has security vulnerabilities, which stem from the lack of input validation. This vulnerability may lead to the deletion of any file in the automatic update server mechanism...

Joomla! CMS 安全漏洞

Joomla! CMS is a content management system developed under the open source Joomla! framework. The Joomla! CMS has security vulnerabilities, which stem from the lack of output escaping mechanisms. This may lead to cross-site scripting vectors in multilingual integrated components...

Joomla 4.0.x < 5.4.4 / 6.0.x < 6.0.4 Joomla 6.0.4 & 5.4.4 Security & Bugfix Release (5944-joomla-6-0-4-5-4-4-security-bugfix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.0.x prior to 5.4.4 or 6.0.x prior to 6.0.4. It is, therefore, affected by a vulnerability. - An improper access check allows unauthorized access to webservice endpoints. CVE-2026-23899 Note that...

EUVD-2026-15653

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through = 1.1.45...

CVE-2026-25341

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through = 1.1.45...

PT-2026-27904

Name of the Vulnerable Software and Affected Versions RSFirewall versions prior to 1.1.45 Description The software contains a flaw due to improper handling of user-supplied data during web page creation, which can lead to stored cross-site scripting XSS. This allows an attacker to inject maliciou...

Exploit for Path Traversal in Joomla Joomla\!

CVE...

[20260305] - Core - Arbitrary file deletion in com_joomlaupdate

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism...

joomla-exploits

joomla-exploits Exploit Title: Joomla! 4.2.8 - Unauthen...

[20260301] - Core - ACL hardening in com_ajax

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers...

[20260303] - Core - XSS vector in com_associations comparison view

Lack of output escaping leads to a XSS vector in the multilingual associations component...

[20260304] - Core - XSS vectors in various article title outputs

Lack of output escaping for article titles leads to XSS vectors in various locations...

[20260306] - Core - Improper access check in webservice endpoints

An improper access check allows unauthorized access to webservice endpoints...

CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla

A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution...

CVE-2026-21628

The CVE-2026-21628 entry concerns the Astroid Framework integration with Joomla. A vulnerable, improperly secured file management feature allows unauthenticated users to upload dangerous data types, enabling remote code execution. Affected: Astroid Framework for Joomla versions 2.0.0 through 3.3....

[20260302] - Core - SQL injection in com_content articles webservice endpoint

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint...

honeypot-server

ReportedIP Honeypot Server !License: BSL 1.1https://img.s...

Exploit for CVE-2026-21627

CVE-2026-21627---Tassos-Novarai...

CVE-2026-21627

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s comajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction...