Joomla! Project vulnerabilities, page 2
140 vulnerabilities
Known vulnerabilities in Joomla! Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.
CVE-2021-23127joomla! projectjoomla! cms+1
EPSS score1.38%
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.CVE-2021-23123joomla! projectjoomla! cms+1EPSS score1.18%
An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or inaccessible modules.CVE-2021-23130joomla! projectjoomla! cms+1EPSS score0.80%
An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.CVE-2021-23125joomla! projectjoomla! cms+1EPSS score0.77%
An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.CVE-2025-63083joomla! projectjoomla! cms+1EPSS score0.21%
Lack of output escaping leads to a XSS vector in the pagebreak plugin.CVE-2025-63082joomla! projectjoomla! cms+1EPSS score0.21%
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.CVE-2025-54477joomla! projectjoomla! cmsEPSS score0.27%
Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.CVE-2025-54476joomla! projectjoomla! cmsEPSS score0.31%
Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.CVE-2025-25227joomla! projectjoomla! cms+1EPSS score0.40%
Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2025-25226joomla! projectjoomla! framework+1EPSS score0.48%
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.CVE-2025-22213joomla! projectjoomla! cmsEPSS score0.49%
Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.CVE-2025-22207joomla! projectjoomla! cmsEPSS score0.45%
Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.CVE-2020-35613joomla! projectjoomla! cms+1EPSS score28.89%
An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user list.CVE-2020-35616joomla! projectjoomla! cms+1EPSS score6.29%
An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations.CVE-2020-35610joomla! projectjoomla! cms+1EPSS score1.36%
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the access level of the corresponding terms.CVE-2020-35611joomla! projectjoomla! cms+1EPSS score1.35%
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current values.CVE-2020-35615joomla! projectjoomla! cms+1EPSS score0.40%
An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability.CVE-2020-35612joomla! projectjoomla! cms+1EPSS score1.63%
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validation, leading to a path traversal vulnerability.CVE-2020-35614joomla! projectjoomla! cms+1EPSS score1.08%
An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page.CVE-2022-27911joomla! projectjoomla! cms+1EPSS score0.59%
An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.