Joomla! 4.x < 4.4.13 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.x prior to 4.4.13 or 5.x prior to 5.2.6. It is, therefore, affected by multiple vulnerabilities. - Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr metho...

Joomla! Authentication Bypass Vulnerability (20250402)

Joomla! is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the quoteNameStr method. An attacker can manipulate SQL queries and retrieve or alter information in the database by injecting malicious SQL code. Note: This is only exploitable if classes extending the affected...

GHSA-6423-85CC-8GF6 Joomla CMS Multi-Factor Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

GHSA-44V2-PRCF-PC3M Joomla Framework Database Package Vulnerable to SQL Injection

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in questio...

Joomla CMS Multi-Factor Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

Joomla Framework Database Package Vulnerable to SQL Injection

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in questio...

CVE-2025-25226 [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in questio...

CVE-2025-25226 [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in questio...

CVE-2025-25226

CVE-2025-25226 affects Joomla Framework’s Database package: the quoteNameStr protected method may allow SQL injection if a subclass invokes it. Original 2.x/3.x packages show no direct usages of the method, so exploitation in the base class is not possible, but subclasses extending the affected c...

CVE-2025-25227 [20250402] - Joomla Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2025-25227

CVE-2025-25227 affects Joomla! Core authentication logic. The vulnerability stems from insufficient state checks that allow bypassing multi-factor authentication (MFA). Public records in OSV/NVD/Nessus indicate affected Joomla! 4.x before 4.4.13 and 5.x before 5.2.6, enabling an MFA bypass with p...

CVE-2025-25227 [20250402] - Joomla Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

PT-2025-15468 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla versions prior to 2.1.1 and 3.3.1 Description: The issue arises from improper handling of identifiers, leading to a SQL injection vulnerability in the quoteNameStr method of the database package. This method is protected and has no...

Joomla 4.0.x < 4.4.13 / 5.0.x < 5.2.6 Joomla 5.2.6 Security Release (5925-joomla-5-2-6-security-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.0.x prior to 4.4.13 or 5.0.x prior to 5.2.6. It is, therefore, affected by a vulnerability. - Insufficient state checks lead to a vector that allows to bypass 2FA checks. CVE-2025-25227 Note that...

PT-2025-15469 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla versions up to 4.4.12 and 5.2.5 Description: The issue is related to insufficient state checks, which create a vector allowing attackers to bypass 2FA checks. This leads to improper authentication. Recommendations: For Joomla versions ...

Joomla! 授权问题漏洞

Joomla! is a free, open source content management system open-sourced by Joomla! An authorization issue vulnerability exists in Joomla! that stems from an insufficient status check that results in bypassing two-factor authentication checks...

Joomla! SQL注入漏洞

Joomla! is a free, open source content management system from Joomla! open source. A SQL injection vulnerability exists in Joomla! that stems from improper handling of identifiers, resulting in a SQL injection vulnerability...

BIT-JOOMLA-2023-23755 [20230502] - Core - Bruteforce prevention within the mfa screen

An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods...

BIT-JOOMLA-2023-23754 [20230501] - Core - Open Redirect and XSS within the mfa select

An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen...