Joomla ! vulnerabilities

276 known vulnerabilities affecting joomla/joomla_!.

Total CVEs

276

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL30HIGH68MEDIUM176LOW2

Vulnerabilities

Page 3 of 14

CVE-2022-23799CRITICALCVSS 9.8≥ 4.0.0, ≤ 4.1.02022-03-30

CVE-2022-23799 [CRITICAL] CVE-2022-23799: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollute An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.

nvd

CVE-2022-23793HIGHCVSS 7.5≥ 3.0.0, ≤ 3.10.6≥ 4.0.0, ≤ 4.1.02022-03-30

CVE-2022-23793 [HIGH] CWE-22 CVE-2022-23793: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifi An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.

nvd

CVE-2022-23800MEDIUMCVSS 6.1≥ 4.0.0, ≤ 4.1.02022-03-30

CVE-2022-23800 [MEDIUM] CWE-79 CVE-2022-23800: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vu An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.

nvd

CVE-2022-23798MEDIUMCVSS 6.1≥ 2.5.0, ≤ 3.10.6≥ 4.0.0, ≤ 4.1.02022-03-30

CVE-2022-23798 [MEDIUM] CWE-601 CVE-2022-23798: An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.

nvd

CVE-2022-23794MEDIUMCVSS 5.3≥ 3.0.0, ≤ 3.10.6≥ 4.0.0, ≤ 4.1.02022-03-30

CVE-2022-23794 [MEDIUM] CWE-209 CVE-2022-23794: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.

nvd

CVE-2022-23801MEDIUMCVSS 6.1≥ 4.0.0, ≤ 4.1.02022-03-30

CVE-2022-23801 [MEDIUM] CWE-79 CVE-2022-23801: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedd An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.

nvd

CVE-2022-23796MEDIUMCVSS 6.1≥ 3.7.0, ≤ 3.10.62022-03-30

CVE-2022-23796 [MEDIUM] CWE-79 CVE-2022-23796: An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.

nvd

CVE-2021-26040CRITICALCVSS 9.1v4.0.02021-08-24

CVE-2021-26040 [CRITICAL] CWE-863 CVE-2021-26040: An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's perm An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.

nvd

CVE-2021-26036HIGHCVSS 7.5≥ 2.5.0, ≤ 3.9.272021-07-07

CVE-2021-26036 [HIGH] CWE-20 CVE-2021-26036: An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table.

nvd

CVE-2021-26038HIGHCVSS 7.5≥ 2.5.0, ≤ 3.9.272021-07-07

CVE-2021-26038 [HIGH] CWE-754 CVE-2021-26038: An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the re An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for com_installer is limited to super users already.

nvd

CVE-2021-26037MEDIUMCVSS 5.3≥ 2.5.0, ≤ 3.9.272021-07-07

CVE-2021-26037 [MEDIUM] CWE-613 CVE-2021-26037: An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine exis An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked.

nvd

CVE-2021-26035MEDIUMCVSS 6.1≥ 3.0.0, ≤ 3.9.272021-07-07

CVE-2021-26035 [MEDIUM] CWE-79 CVE-2021-26035: An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of t An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.

nvd

CVE-2021-26039MEDIUMCVSS 6.1≥ 3.0.0, ≤ 3.9.272021-07-07

CVE-2021-26039 [MEDIUM] CWE-79 CVE-2021-26039: An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view o An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability.

nvd

CVE-2010-1435CRITICALCVSS 9.8≥ 1.5.0, ≤ 1.5.15vJoomla core from 1.5.0 up to and including 1.5.152021-06-21

CVE-2010-1435 [CRITICAL] CWE-863 CVE-2010-1435: Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.

cvelistv5nvd

CVE-2010-1433CRITICALCVSS 9.8≥ 1.5.0, ≤ 1.5.15vJoomla core from 1.5.0 up to and including 1.5.152021-06-21

CVE-2010-1433 [CRITICAL] CWE-434 CVE-2010-1433: Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the appl Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attack

cvelistv5nvd

CVE-2010-1434HIGHCVSS 7.5≥ 1.5.0, ≤ 1.5.15vJoomla core from 1.5.0 up to and including 1.5.152021-06-21

CVE-2010-1434 [HIGH] CWE-384 CVE-2010-1434: Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hi Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.

cvelistv5nvd

CVE-2010-1432HIGHCVSS 7.5≥ 1.5.0, ≤ 1.5.15vJoomla core from 1.5.0 up to and including 1.5.152021-06-21

CVE-2010-1432 [HIGH] CWE-200 CVE-2010-1432: Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue t Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.

cvelistv5nvd

CVE-2021-26033MEDIUMCVSS 6.5≥ 3.0.0, ≤ 3.9.262021-05-26

CVE-2021-26033 [MEDIUM] CWE-352 CVE-2021-26033: An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnera An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint.

nvd

CVE-2021-26032MEDIUMCVSS 6.1≥ 3.0.0, ≤ 3.9.262021-05-26

CVE-2021-26032 [MEDIUM] CWE-79 CVE-2021-26032: An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block li An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.

nvd

CVE-2021-26034MEDIUMCVSS 6.5≥ 3.0.0, ≤ 3.9.262021-05-26

CVE-2021-26034 [MEDIUM] CWE-352 CVE-2021-26034: An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnera An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.

nvd

← Previous3 / 14Next →