Joomla ! vulnerabilities

CVE-2019-14654 [HIGH] CVE-2019-14654: In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.

CVE-2013-3242 [MEDIUM] CWE-20 CVE-2013-3242: plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors.

CVE-2024-21726 [MEDIUM] CWE-79 CVE-2024-21726: Inadequate content filtering leads to XSS vulnerabilities in various components. Inadequate content filtering leads to XSS vulnerabilities in various components.

CVE-2018-11325 [CRITICAL] CWE-209 CVE-2018-11325: An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill pas An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen.

CVE-2019-19846 [CRITICAL] CWE-89 CVE-2019-19846: In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries cau In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

CVE-2022-23797 [CRITICAL] CWE-89 CVE-2022-23797: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.

CVE-2025-25226 [CRITICAL] CWE-89 CVE-2025-25226: Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original databa

CVE-2011-1151 [CRITICAL] CWE-89 CVE-2011-1151: Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters. Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.

CVE-2019-11831 [CRITICAL] CWE-22 CVE-2019-11831: The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TY The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

CVE-2016-9836 [CRITICAL] CWE-284 CVE-2016-9836: The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consi The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the `.php6`, `.php7`, `.phtml`, and `.phpt` extensions. Additionally, JHelperMedia::canUpload() did not blacklist t

CVE-2018-6377 [MEDIUM] CWE-79 CVE-2018-6377: In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in m In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox

CVE-2018-17855 [HIGH] CWE-269 CVE-2018-17855: An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.

CVE-2018-15882 [CRITICAL] CWE-434 CVE-2018-15882: An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could a An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter.

CVE-2019-7743 [CRITICAL] CWE-502 CVE-2019-7743: An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objectio An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

CVE-2022-23795 [CRITICAL] CWE-287 CVE-2022-23795: An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bo An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

CVE-2018-11323 [HIGH] CWE-269 CVE-2018-11323: An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higher permissions.

CVE-2017-11364 [HIGH] CWE-295 CVE-2017-11364: The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which al The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.

CVE-2026-40384 [HIGH] CWE-22 CVE-2026-40384: An improper validation of the search parameter of the com_media files API endpoint leads to a path t An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

CVE-2026-48902 [CRITICAL] CWE-319 CVE-2026-48902: The password and username reset features created plain http links for https connections if the "Forc The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

CVE-2019-6263 [MEDIUM] CWE-79 CVE-2019-6263: An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.