Joomla ! vulnerabilities

CVE-2026-25901 [MEDIUM] CWE-79 CVE-2026-25901: Lack of output escaping leads to a XSS vector in the multilingual associations component. Lack of output escaping leads to a XSS vector in the multilingual associations component.

CVE-2026-30894 [MEDIUM] CWE-79 CVE-2026-30894: Lack of output escaping leads to a XSS vector in the content history component. Lack of output escaping leads to a XSS vector in the content history component.

CVE-2025-63083 [MEDIUM] CWE-79 CVE-2025-63083: Lack of output escaping leads to a XSS vector in the pagebreak plugin. Lack of output escaping leads to a XSS vector in the pagebreak plugin.

CVE-2025-63082 [MEDIUM] CWE-79 CVE-2025-63082: Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img t Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.

CVE-2020-15698 [MEDIUM] CVE-2020-15698: An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information sc An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials

CVE-2019-19845 [MEDIUM] CWE-22 CVE-2019-19845: In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure. In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.

CVE-2019-18674 [MEDIUM] CWE-862 CVE-2019-18674: An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping file An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure.

CVE-2020-11891 [MEDIUM] CVE-2020-11891: An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section o An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.

CVE-2020-11889 [MEDIUM] CVE-2020-11889: An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section o An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.

CVE-2026-21631 [MEDIUM] CWE-79 CVE-2026-21631: Lack of output escaping leads to a XSS vector in the multilingual associations component. Lack of output escaping leads to a XSS vector in the multilingual associations component.

CVE-2006-4471 [MEDIUM] CWE-434 CVE-2006-4471: The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to u The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stories/ directory via unspecified vectors.

CVE-2020-24598 [MEDIUM] CWE-601 CVE-2020-24598: An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of co An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect.

CVE-2019-7739 [MEDIUM] CVE-2019-7739: An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child setti An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior. However, it might be unexpected for the user because the configuration dialog lacks an additional message to explain this.

CVE-2019-11809 [MEDIUM] CWE-79 CVE-2019-11809: An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.

CVE-2019-7742 [MEDIUM] CWE-79 CVE-2019-7742: An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector.

CVE-2019-6264 [MEDIUM] CWE-79 CVE-2019-6264: An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a store An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability.

CVE-2019-6261 [MEDIUM] CWE-79 CVE-2019-6261: An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a store An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.

CVE-2021-26039 [MEDIUM] CWE-79 CVE-2021-26039: An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view o An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability.

CVE-2022-23798 [MEDIUM] CWE-601 CVE-2022-23798: An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.

CVE-2022-23796 [MEDIUM] CWE-79 CVE-2022-23796: An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.