Joomla ! vulnerabilities

CVE-2019-9714 [MEDIUM] CWE-79 CVE-2019-9714: An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS.

CVE-2019-9711 [MEDIUM] CWE-79 CVE-2019-9711: An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS.

CVE-2024-26279 [MEDIUM] CWE-79 CVE-2024-26279: The wrapper extensions do not correctly validate inputs, leading to XSS vectors. The wrapper extensions do not correctly validate inputs, leading to XSS vectors.

CVE-2023-23754 [MEDIUM] CWE-20 CVE-2023-23754: An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redi An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen.

CVE-2024-27186 [MEDIUM] CWE-79 CVE-2024-27186: The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.

CVE-2021-26028 [MEDIUM] CWE-22 CVE-2021-26028: An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip packag An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

CVE-2012-0819 [MEDIUM] CVE-2012-0819: Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0821.

CVE-2012-0821 [MEDIUM] CVE-2012-0821: Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0819.

CVE-2011-3595 [MEDIUM] CWE-79 CVE-2011-3595: Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in t Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.

CVE-2012-0837 [MEDIUM] CWE-200 CVE-2012-0837: Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path v Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator."

CVE-2013-3056 [MEDIUM] CWE-264 CVE-2013-3056: Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass inten Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors.

CVE-2013-3057 [MEDIUM] CWE-264 CVE-2013-3057: Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass inten Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors.

CVE-2026-73372 [MEDIUM] CWE-284 CVE-2026-73372: Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1 Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.

CVE-2012-2748 [MEDIUM] CVE-2012-2748: Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to obtain sensitive Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to obtain sensitive information via vectors related to "Inadequate filtering" and a "SQL error."

CVE-2018-11328 [MEDIUM] CWE-79 CVE-2018-11328: An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issue An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI containing a username and password when the Location: header cannot be used), a lack of escaping the user-info component of the URI could result in an XSS vulnerability.

CVE-2017-16633 [MEDIUM] CWE-200 CVE-2017-16633: In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's cust In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.

CVE-2026-48900 [MEDIUM] CWE-284 CVE-2026-48900: An improper access check allowed low privileged users to edit the task types of existing scheduler t An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.

CVE-2015-5608 [MEDIUM] CWE-601 CVE-2015-5608: Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1. Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.

CVE-2017-8057 [MEDIUM] CWE-200 CVE-2017-8057: In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on syst In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting.

CVE-2011-2488 [MEDIUM] CWE-200 CVE-2011-2488: Joomla! before 1.5.23 does not properly check for errors, which allows remote attackers to obtain se Joomla! before 1.5.23 does not properly check for errors, which allows remote attackers to obtain sensitive information via unspecified vectors.