Joomla! Project Joomla! CMS vulnerabilities, page 4
137 vulnerabilities
Known vulnerabilities in Joomla! Project Joomla! CMS, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2024-40748joomla! project · joomla! cms +1 more[20250102] - Core - XSS vector in the id attribute of menu listsLack of output escaping in the id attribute of menu lists.EPSS0.43%HighCVE-2024-40749joomla! project · joomla! cms +1 more[20250103] - Core - Read ACL violation in multiple core viewsImproper Access Controls allows access to protected views.EPSS0.39%MediumCVE-2024-40743joomla! project · joomla! cms +1 more[20240805] - Core - XSS vectors in Outputfilter::strip* methodsThe stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.EPSS0.27%MediumCVE-2024-26279joomla! project · joomla! cms +1 more[20240704] - Core - XSS in Wrapper extensionsThe wrapper extensions do not correctly validate inputs, leading to XSS vectors.EPSS0.46%MediumCVE-2024-26278joomla! project · joomla! cms +1 more[20240705] - Core - XSS in com_fields default field valueThe Custom Fields component not correctly filter inputs, leading to a XSS vector.EPSS0.45%MediumCVE-2024-27186joomla! project · joomla! cms +1 more[20240803] - Core - XSS in HTML Mail TemplatesThe mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.EPSS0.27%CriticalCVE-2024-27185joomla! project · joomla! cms +1 more[20240802] - Core - Cache Poisoning in PaginationThe pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.EPSS0.44%MediumCVE-2024-27184joomla! project · joomla! cms +1 more[20240801] - Core - Inadequate validation of internal URLsInadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..EPSS0.25%HighCVE-2024-27187joomla! project · joomla! cms +1 more[20240804] - Core - Improper ACL for backend profile viewImproper Access Controls allows backend users to overwrite their username when disallowed.EPSS0.35%MediumCVE-2026-21631joomla! project · joomla! cms +1 moreJoomla! Core - [20260303] - XSS vector in com_associations comparison viewLack of output escaping leads to a XSS vector in the multilingual associations component.EPSS0.22%HighCVE-2026-21630joomla! project · joomla! cms +1 moreJoomla! Core - [20260302] - SQL injection in com_content articles webservice endpointImproperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.EPSS0.34%HighCVE-2026-21629joomla! project · joomla! cms +1 moreJoomla! Core - [20260301] - ACL hardening in com_ajaxThe ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.EPSS0.25%MediumCVE-2026-21632joomla! project · joomla! cms +1 moreJoomla! Core - [20260304] - XSS vectors in various article title outputsLack of output escaping for article titles leads to XSS vectors in various locations.EPSS0.19%HighCVE-2026-73337joomla! project · joomla! cms +1 moreJoomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.EPSS0.46%MediumCVE-2026-73372joomla! project · joomla! cms +1 moreJoomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2An improper access check injects contact information for unaccessible contact items into schema.org snippets.EPSS0.29%MediumCVE-2026-73371joomla! project · joomla! cms +1 moreJoomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2An improper access check allows unauthorized users to perform copy batch operations on uneditable items.EPSS0.29%CriticalCVE-2026-73373joomla! project · joomla! cms +2 moreJoomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.EPSS0.65%MediumCVE-2026-73336joomla! project · joomla! cms +1 moreJoomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2Improper escaping flags lead to an XSS vector in schema.org markup outputs.EPSS0.27%CriticalCVE-2026-40383joomla! project · joomla! cms +1 moreJoomla! Core - [20260509] - LFI in HTMLView layout parameterAn improper validation of user-supplied input leads to a local file inclusion vulnerability.EPSS0.56%HighCVE-2026-40384joomla! project · joomla! cms +1 moreJoomla! Core - [20260510] - Path traversal in com_media webservice endpointAn improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.EPSS0.49%