CVE-2024-21724

Joomla! CMS core contains a Cross-site Scripting (XSS) vulnerability due to inadequate input validation in media selection fields (CVE-2024-21724). Affected software: Joomla! core components handling media selection in extensions. Root cause: insufficient validation in media selection input paths...

CVE-2024-21723

CVE-2024-21723 describes an open redirect in the Joomla! core installation application caused by inadequate URL parsing. Public docs consistently identify this as an Open Redirect vulnerability in Joomla! installation, enabling redirection to an arbitrary URL when a crafted link is processed. The...

CVE-2024-21726

Summary (CVE-2024-21726): In Joomla! ecosystems (CMS and Framework), inadequate content filtering in the filter code can allow cross-site scripting (XSS) in multiple components. The CVE is documented with a CVSS v3.1 base score of 6.5 (Network, Low/Low impacts except Confidentiality: Low, Availab...

CVE-2024-21722

The issue CVE-2024-21722 affects Joomla! CMS: the MFA management views did not properly terminate existing user sessions when a user’s MFA methods were modified. The root cause is insufficient session expiration tied to MFA changes, which can allow previously authenticated sessions to persist aft...

CVE-2024-21725

CVE-2024-21725 describes an XSS vulnerability due to inadequate escaping of email addresses in various Joomla! components. Affected product: Joomla! CMS (web components referencing mail address outputs). Root cause: inadequate escaping of email addresses. Impact (as stated in sources): cross-site...

CVE-2019-11358

CVE-2019-11358 is a prototype pollution vulnerability in jQuery (before 3.4.0) where mishandling of extend(true, {}, ...) can extend Object.prototype if an unsanitized source object has an enumerable proto property. The Core issue is triggered when a polluted prototype is introduced via nested ob...

CVE-2016-10033

PHPMailer CVE-2016-10033 affects the isMail transport in PHPMailer prior to 5.2.18, where an attacker can craft the Sender property to inject an extra parameter to the mail() call and achieve remote code execution on the web server. Related entries note the issue as a fix in PHPMailer versions 5....

CVE-2023-23752

CVE-2023-23752 affects Joomla! 4.0.0–4.2.7, where an improper access check on webservice endpoints allows unauthenticated access, enabling information disclosure. Exploit PoCs in public repos demonstrate unauthenticated disclosure against Joomla! 4.2.8 in some cases. Root cause: insufficient auth...

CVE-2022-23797

CVE-2022-23797 affects Joomla! core: versions 3.0.0–3.10.6 and 4.0.0–4.1.0. The issue arises from inadequate filtering on the selected Ids in a request, enabling a potential SQL injection. Documented impact is high (based on CVSS3.1: CRITICAL; CVSS2: HIGH). No exploitation details or active explo...

CVE-2017-8917

CVE-2017-8917 is a Joomla! SQL injection vulnerability in the com_fields component (affecting Joomla! 3.7.0 introduced, fixed in 3.7.1). The root cause is improper sanitization of the list[fullordering] parameter, enabling an SQL payload that can trigger error-based output (e.g., via UpdateXML) a...

CVE-2023-40626

CVE-2023-40626 concerns Joomla! information disclosure via the language file parsing process, which can be manipulated to expose environment variables. The vulnerability affects Joomla! instances that self-report as vulnerable versions (e.g., Joomla! 5.x prior to 5.0.1 and 1.6.x prior to 4.4.1) p...

CVE-2016-10045

PHPMailer–CVE-2016-10045 affects the isMail transport in PHPMailer before 5.2.20. An improper interaction between escapeshellarg and internal escaping in the mail() function could allow remote attackers to pass extra parameters to the mail command and execute arbitrary code. This vulnerability ex...

CVE-2022-23793

CVE-2022-23793 affects Joomla! 3.0.0–3.10.6 and 4.0.0–4.1.0. The issue is a zip-slip/path-traversal in the tar extractor that could write files outside the intended path when extracting crafted tar archives. Impact details are stated in the sources, but exploitation specifics are not provided. Re...

CVE-2014-6632

CVE-2014-6632 affects Joomla! 2.5.x prior to 2.5.25, 3.x prior to 3.2.4, and 3.3.x prior to 3.3.4. The vulnerability allows remote attackers to authenticate and bypass intended access restrictions via LDAP authentication vectors. Linked/related advisories confirm an unauthorized login issue tied ...

CVE-2016-9838

Affected software: Joomla! prior to 3.6.5. Vulnerable component: components/com_users/models/registration.php, where registration form data stored in the session is incorrectly filtered on validation error. Root cause: improper filtering/validation allows an attacker to access a registered user’s...

CVE-2019-11831

CVE-2019-11831 affects Drupal’s TYPO3 phar-stream-wrapper integration. The vulnerability arises from incomplete validation in the phar:// stream wrapper library, enabling directory traversal that bypasses a deserialization protection mechanism. Affected: phar-stream-wrapper versions 2.x before 2....

CVE-2015-8562

CVE-2015-8562 affects Joomla! 1.5.x, 2.x, and 3.x prior to 3.4.6. The vulnerability enables remote PHP object injection that can lead to arbitrary code execution, originally described as exploitable via the HTTP User-Agent header. Public PoCs and exploits exist (e.g., Exploit-DB entries for CVE-2...

CVE-2025-25226

CVE-2025-25226 affects Joomla Framework’s Database package: the quoteNameStr protected method may allow SQL injection if a subclass invokes it. Original 2.x/3.x packages show no direct usages of the method, so exploitation in the base class is not possible, but subclasses extending the affected c...

CVE-2019-12765

CVE-2019-12765 affects Joomla! prior to 3.9.7. The issue is a CSV injection in the CSV export of the com_actionslogs component, caused by insufficient input validation during export. Public references (NVD/NIST, Nessus, OSV, CNVD, ENISA) confirm the vulnerability in Joomla! versions 3.9.0–3.9.6 (...

CVE-2021-26036

CVE-2021-26036 affects Joomla! 2.5.0 through 3.9.27 due to missing input validation that can corrupt the usergroups table. Impact is described as a DoS via manipulation of usergroup data, with CVSS scores indicating NETWORK attack, low complexity, and availability impact HIGH in CVSS v3.1 (base 7...

CVE-2019-19846

CVE-2019-19846 affects Joomla! core prior to 3.9.14 (and 2.5.x to 3.9.13 per Nessus entry). The vulnerability stems from lack of validation of configuration parameters used in SQL queries, enabling SQL injection via multiple vectors. Impact per sources: high/severe potential data exposure/modific...

CVE-2016-8870

CVE-2016-8870 affects Joomla! core (registration flow) prior to 3.6.4. The register method in UsersModelRegistration fails to respect the Allow User Registration setting, allowing remote creation of accounts even when registration is disabled. Exploitation details are documented across multiple s...

CVE-2024-27185

CVE-2024-27185 affects Joomla core: the pagination class accepts arbitrary parameters in links, which can lead to cache poisoning attack vectors. The vulnerability is documented across multiple feeds (NVD, OSV, Nessus/NASL) with a reported CVSS v3.1 base score of 9.1 (CRITICAL) and an attack vect...

CVE-2020-35613

CVE-2020-35613 affects Joomla! 3.0.0 through 3.9.22. The issue is a SQL injection in the backend user list caused by an improperly configured filter blacklist. Multiple sources in the connected data corroborate this vulnerability in the core; the root cause is the flawed filter blacklist allowing...

CVE-2015-6939

CVE-2015-6939 affects Joomla! core login module in version 3.4.x prior to 3.4.4. Root cause: inadequate escaping in the login component enables cross-site scripting (XSS). Impact: remote attackers can inject arbitrary script or HTML in a user’s browser, via unspecified vectors (as described in so...

CVE-2026-48904

CVE-2026-48904 affects Joomla! Core via the com_users webservice endpoints. An improper access check enables privilege escalation from group editing operations, leading to potential HIGH/CRITICAL impact per cited CVSS vectors (C/H, I/H, A/H). The public material specifies the affected component (...

CVE-2022-23799

CVE-2022-23799 affects Joomla! 4.0.0–4.1.0. The issue arises in JInput where, under certain conditions, input bags are polluted with $_REQUEST data, potentially impacting confidentiality, integrity, and availability. The connected sources confirm the affected range and the root cause (JInput poll...

CVE-2025-25227

CVE-2025-25227 affects Joomla! Core authentication logic. The vulnerability stems from insufficient state checks that allow bypassing multi-factor authentication (MFA). Public records in OSV/NVD/Nessus indicate affected Joomla! 4.x before 4.4.13 and 5.x before 5.2.6, enabling an MFA bypass with p...

CVE-2022-23798

CVE-2022-23798 affects Joomla! core versions 2.5.0–3.10.6 and 4.0.0–4.1.0. The issue is inadequate validation of URLs that can lead to an invalid check of whether a redirect URL is internal or not. This is described in the CVE entry and corroborated by multiple feeds (NVD/OSV/CVE listing). The vu...

CVE-2017-14596

CVE-2017-14596: Joomla! LDAP authentication plugin can disclose usernames and passwords when LDAP authentication is configured. Root cause is inadequate escaping in the LDAP plugin. Affected product: Joomla! versions earlier than 3.8.0. Impact is high for confidentiality (exposure of credentials)...

CVE-2021-26038

Joomla! 2.5.0 through 3.9.27 is affected by CVE-2021-26038 due to an install action in com_installer lacking hardcoded ACL checks for superusers, enabling privilege escalation. The default ACL for com_installer is limited to super users, so the default system is not affected. A patch is available...

CVE-2019-16725

CVE-2019-16725 affects Joomla! 3.x before 3.9.12. The vulnerability arises from inadequate escaping in the logo parameter of the default templates, enabling cross-site scripting (XSS). The NVD records CVSS v3.1 base score 6.1 (NETWORK, LOW ATTACK COMPLEXITY, UI REQUIRED, Privileges NONE) and CVSS...

CVE-2016-9836

CVE-2016-9836 affects Joomla! CMS versions up to 3.6.4 (self-reported). The file scanning in JFilterInput::isFileSafe() fails to consider alternative PHP extensions (e.g., .php6, .php7, .phtml, .phpt) when validating uploaded files, enabling execution of uploaded PHP content. Additionally, JHelpe...

CVE-2019-19845

CVE-2019-19845 affects Joomla! prior to 3.9.14. The root cause is a missing access check in framework files, which can lead to a path disclosure. This vulnerability is documented across multiple sources (e.g., Red Hat, Nessus/Nessus plugin 98936, CVE databases) and is specifically tied to Joomla!...

CVE-2022-23794

CVE-2022-23794 affects Joomla! 3.0.0–3.10.6 and 4.0.0–4.1.0. Uploading a filename with excessive length triggers an error that reveals the web application’s source code path via filesystem error messages, constituting information disclosure. The public-facing sources (NVD, OSV, CVE records) descr...

CVE-2018-17856

Summary: CVE-2018-17856 affects Joomla! before 3.8.13. The com_joomlaupdate component permits arbitrary code execution due to a default ACL configuration that allows Administrator-level users to access com_joomlaupdate. This leads to remote code execution with high impact; CVSSv3 base score 7.2 (...

CVE-2016-8869

CVE-2016-8869 affects Joomla! core user registration (Joomla! versions before 3.6.4). The vulnerability arises from the register method in UsersModelRegistration (controllers/user.php) handling unfiltered data, enabling unauthenticated remote privilege escalation by creating a privileged account....

CVE-2021-23132

The CVE-2021-23132 issue affects Joomla! core: versions 3.0.0 through 3.9.24 allow image-upload paths in com_media that were not intended, enabling access to unintended directories. Root cause: insecure handling in com_media leading to path exposure and potential exploitation. Documented impact i...

CVE-2022-23800

CVE-2022-23800 affects Joomla! 4.0.0 through 4.1.0. The issue is insufficient content filtering that enables cross-site scripting (XSS) in various components. The connected documents corroborate the affected range and describe the vulnerability as an XSS due to inadequate filtering, but do not pr...

CVE-2019-18674

Joomla! is affected by CVE-2019-18674 due to a missing access check in the phputf8 mapping files, enabling path disclosure in versions prior to 3.9.13. The issue is described in vendor advisories (e.g., Joomla security centre) and Red Hat’s CVE entry reiterates the same flaw. Affected software: J...

CVE-2019-6263

CVE-2019-6263 affects Joomla!

CVE-2021-26031

CVE-2021-26031 affects Joomla! 3.0.0 through 3.9.25, where inadequate filters on module layout settings could lead to a local file inclusion (LFI). The root cause is insufficient input filtering in the module layout settings, allowing access to local files. The available sources confirm the exist...

CVE-2020-10243

Joomla! before 3.9.16 is affected by a SQL injection in the Featured Articles frontend menutype caused by lack of type casting of a variable in a SQL statement. Root cause: improper handling of that variable within the query. Impact: SQL injection potential as described in multiple sources. Remed...

CVE-2023-23750

CVE-2023-23750 : Joomla! Core on versions 4.0.0–4.2.6 suffers a CSRF vulnerability in the handling of post-installation messages due to a missing token check. The issue could enable unauthorized actions via forged requests within the affected workflow. Public sources in connected documents confir...

CVE-2024-40749

The CVE-2024-40749 entry concerns Joomla! core: an improper access control (ACL) read-violation that allows access to protected core views. The incident is described as affecting multiple core views via an ACL leakage, with a CVSS v3.1 base score of 7.5 (Network access, no user interaction requir...

CVE-2020-35614

Joomla! is affected from 3.9.0 through 3.9.22 by a backend login user enumeration vulnerability caused by improper handling of the username. The issue enables an attacker to infer valid usernames via the backend login page. Remediation per linked sources is to update Joomla! to a version that fix...

CVE-2021-26028

CVE-2021-26028 affects Joomla! 3.0.0–3.9.24. A vulnerability in the core ZIP extraction path traversal allows a crafted zip file to write files outside the intended directory. Connected advisories confirm this is a path-traversal issue within the joomla/archive zip class, with public references n...

CVE-2020-8421

CVE-2020-8421 affects Joomla! core prior to 3.9.15, specifically the com_actionlogs component. The issue is described as inadequate escaping of usernames, which enables cross-site scripting (XSS) attacks. The vulnerability is present in Joomla! 3.x up to version 3.9.14, with a fix introduced in 3...

CVE-2020-35611

CVE-2020-35611 affects Joomla! 2.5.0 through 3.9.22. The global configuration page outputs secrets in the HTML, disclosing current values due to a misconfiguration. Impact is information disclosure of sensitive configuration data. Remediation: update to a version that removes secrets from the HTM...

CVE-2021-23125

Joomla! 3.1.0 through 3.9.23 is affected by CVE-2021-23125 due to lack of escaping of image-related parameters in com_tags views, enabling cross-site scripting (XSS). The root cause is improper escaping in image parameter handling within com_tags, leading to XSS vectors as described in multiple C...