Joomla ! vulnerabilities

CVE-2018-12712 [HIGH] CWE-20 CVE-2018-12712: An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classn An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion.

CVE-2014-6632 [HIGH] CWE-287 CVE-2014-6632: Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to aut Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.

CVE-2021-26040 [CRITICAL] CWE-863 CVE-2021-26040: An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's perm An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.

CVE-2024-27185 [CRITICAL] CWE-444 CVE-2024-27185: The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vecto The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.

CVE-2016-9081 [CRITICAL] CWE-255 CVE-2016-9081: Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors.

CVE-2022-23799 [CRITICAL] CVE-2022-23799: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollute An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.

CVE-2015-8769 [HIGH] CWE-89 CVE-2015-8769: SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL co SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2026-23898 [HIGH] CWE-73 CVE-2026-23898: Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

CVE-2021-23128 [CRITICAL] CVE-2021-23128: An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval impleme An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential insecure implemetation. That has now been replaced with a call to 'random_bytes()' and its backport that is shipped within random_compat.

CVE-2018-17856 [HIGH] CVE-2018-17856: An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.

CVE-2014-7984 [HIGH] CWE-264 CVE-2014-7984: Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and byp Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication.

CVE-2021-23132 [HIGH] CVE-2021-23132: An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intend An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

CVE-2026-48896 [HIGH] CWE-287 CVE-2026-48896: Insufficient state checks lead to a vector that allows to bypass 2FA checks. Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVE-2020-35616 [HIGH] CWE-20 CVE-2020-35616: An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations.

CVE-2020-10238 [HIGH] CWE-668 CVE-2020-10238: An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.

CVE-2021-23127 [CRITICAL] CVE-2021-23127: An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

CVE-2018-11322 [HIGH] CWE-434 CVE-2018-11322: An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR fi An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver.

CVE-2024-40749 [HIGH] CWE-284 CVE-2024-40749: Improper Access Controls allows access to protected views. Improper Access Controls allows access to protected views.

CVE-2026-48897 [HIGH] CWE-287 CVE-2026-48897: Insufficient state checks lead to a vector that allows to bypass 2FA checks. Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVE-2022-23793 [HIGH] CWE-22 CVE-2022-23793: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifi An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.