Joomla ! vulnerabilities

CVE-2013-1453 [HIGH] CVE-2013-1453: plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information, delete arbitrary directories, conduct SQL injection attacks, and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowe

CVE-2018-8045 [HIGH] CWE-89 CVE-2018-8045: In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view.

CVE-2010-1433 [CRITICAL] CWE-434 CVE-2010-1433: Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the appl Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attack

CVE-2026-35223 [CRITICAL] CWE-284 CVE-2026-35223: An improper access check allows unauthorized access to com_config webservice endpoints. An improper access check allows unauthorized access to com_config webservice endpoints.

CVE-2017-16634 [CRITICAL] CWE-287 CVE-2017-16634: In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication meth In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

CVE-2018-6376 [CRITICAL] CWE-89 CVE-2018-6376: In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL in In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.

CVE-2021-23124 [MEDIUM] CWE-79 CVE-2021-23124: An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs ari An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks.

CVE-2026-73373 [CRITICAL] CWE-434 CVE-2026-73373: Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

CVE-2026-48904 [CRITICAL] CWE-284 CVE-2026-48904: An improper access check allows privelege escalation through the com_users group editing webservice An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

CVE-2026-48957 [HIGH] CWE-284 CVE-2026-48957: An improper access check allows unauthorized users to access com_privacy datasets. An improper access check allows unauthorized users to access com_privacy datasets.

CVE-2026-23899 [HIGH] CWE-284 CVE-2026-23899: An improper access check allows unauthorized access to webservice endpoints. An improper access check allows unauthorized access to webservice endpoints.

CVE-2021-26030 [MEDIUM] CWE-79 CVE-2021-26030: An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks usi An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page

CVE-2026-40383 [CRITICAL] CWE-22 CVE-2026-40383: An improper validation of user-supplied input leads to a local file inclusion vulnerability. An improper validation of user-supplied input leads to a local file inclusion vulnerability.

CVE-2026-48898 [CRITICAL] CWE-284 CVE-2026-48898: An improper access check allows privilege escalation through the com_users batch task. An improper access check allows privilege escalation through the com_users batch task.

CVE-2026-48899 [CRITICAL] CWE-284 CVE-2026-48899: An improper access check allows privilege escalation through the com_users batch task. An improper access check allows privilege escalation through the com_users batch task.

CVE-2020-10239 [HIGH] CWE-863 CVE-2020-10239: An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of c An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.

CVE-2026-48958 [HIGH] CWE-284 CVE-2026-48958: An improper access check allows unauthorized users to create custom fields via webservices endpoints An improper access check allows unauthorized users to create custom fields via webservices endpoints.

CVE-2026-48948 [HIGH] CWE-284 CVE-2026-48948: An improper access check allows user to download vcard exports of com_contact contacts that are inac An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

CVE-2020-10243 [CRITICAL] CWE-89 CVE-2020-10243: An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL st An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.

CVE-2010-1435 [CRITICAL] CWE-863 CVE-2010-1435: Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.