Joomla ! vulnerabilities

CVE-2017-14596 [CRITICAL] CWE-90 CVE-2017-14596: In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a discl In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.

CVE-2026-35221 [CRITICAL] CWE-89 CVE-2026-35221: Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_fi Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

CVE-2026-35222 [CRITICAL] CWE-89 CVE-2026-35222: Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

CVE-2026-21630 [HIGH] CWE-89 CVE-2026-21630: Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endp Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

CVE-2019-14654 [HIGH] CVE-2019-14654: In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

CVE-2013-3242 [MEDIUM] CWE-20 CVE-2013-3242: plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors.

CVE-2016-9836 [CRITICAL] CWE-284 CVE-2016-9836: The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consi The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the `.php6`, `.php7`, `.phtml`, and `.phpt` extensions. Additionally, JHelperMedia::canUpload() did not blacklist t

CVE-2019-19846 [CRITICAL] CWE-89 CVE-2019-19846: In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries cau In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

CVE-2011-1151 [CRITICAL] CWE-89 CVE-2011-1151: Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters. Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.

CVE-2019-11831 [CRITICAL] CWE-22 CVE-2019-11831: The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TY The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

CVE-2024-21726 [MEDIUM] CWE-79 CVE-2024-21726: Inadequate content filtering leads to XSS vulnerabilities in various components. Inadequate content filtering leads to XSS vulnerabilities in various components.

CVE-2018-11325 [CRITICAL] CWE-209 CVE-2018-11325: An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill pas An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen.

CVE-2022-23797 [CRITICAL] CWE-89 CVE-2022-23797: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.

CVE-2026-92227 [HIGH] CWE-287 CVE-2026-92227: Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4. Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.

CVE-2025-25226 [CRITICAL] CWE-89 CVE-2025-25226: Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original databa

CVE-2026-48902 [CRITICAL] CWE-319 CVE-2026-48902: The password and username reset features created plain http links for https connections if the "Forc The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

CVE-2018-6377 [MEDIUM] CWE-79 CVE-2018-6377: In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in m In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox

CVE-2026-73337 [HIGH] CWE-287 CVE-2026-73337: Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insuff Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVE-2017-11364 [HIGH] CWE-295 CVE-2017-11364: The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which al The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.

CVE-2018-17855 [HIGH] CWE-269 CVE-2018-17855: An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.