Joomla ! vulnerabilities

CVE-2018-15882 [CRITICAL] CWE-434 CVE-2018-15882: An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could a An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload filter.

CVE-2022-23795 [CRITICAL] CWE-287 CVE-2022-23795: An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bo An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

CVE-2019-7743 [CRITICAL] CWE-502 CVE-2019-7743: An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objectio An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

CVE-2019-6263 [MEDIUM] CWE-79 CVE-2019-6263: An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.

CVE-2026-40384 [HIGH] CWE-22 CVE-2026-40384: An improper validation of the search parameter of the com_media files API endpoint leads to a path t An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

CVE-2018-11323 [HIGH] CWE-269 CVE-2018-11323: An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higher permissions.

CVE-2026-71573 [HIGH] CWE-93 CVE-2026-71573: Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

CVE-2018-12712 [HIGH] CWE-20 CVE-2018-12712: An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classn An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion.

CVE-2016-9081 [CRITICAL] CWE-255 CVE-2016-9081: Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors.

CVE-2014-6632 [HIGH] CWE-287 CVE-2014-6632: Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to aut Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.

CVE-2021-26040 [CRITICAL] CWE-863 CVE-2021-26040: An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's perm An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.

CVE-2024-27185 [CRITICAL] CWE-444 CVE-2024-27185: The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vecto The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.

CVE-2022-23799 [CRITICAL] CVE-2022-23799: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollute An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.

CVE-2015-8769 [HIGH] CWE-89 CVE-2015-8769: SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL co SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2026-23898 [HIGH] CWE-73 CVE-2026-23898: Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

CVE-2018-17856 [HIGH] CVE-2018-17856: An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.

CVE-2014-7984 [HIGH] CWE-264 CVE-2014-7984: Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and byp Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.

CVE-2021-23132 [HIGH] CVE-2021-23132: An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intend An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

CVE-2026-48897 [HIGH] CWE-287 CVE-2026-48897: Insufficient state checks lead to a vector that allows to bypass 2FA checks. Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVE-2026-48896 [HIGH] CWE-287 CVE-2026-48896: Insufficient state checks lead to a vector that allows to bypass 2FA checks. Insufficient state checks lead to a vector that allows to bypass 2FA checks.