Joomla ! vulnerabilities

CVE-2020-15698 [MEDIUM] CVE-2020-15698: An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information sc An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials

CVE-2008-4122 [HIGH] CWE-319 CVE-2008-4122: Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes i Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVE-2006-4471 [MEDIUM] CWE-434 CVE-2006-4471: The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to u The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stories/ directory via unspecified vectors.

CVE-2018-6380 [MEDIUM] CWE-79 CVE-2018-6380: In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.

CVE-2018-6379 [MEDIUM] CWE-79 CVE-2018-6379: In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.

CVE-2018-12711 [MEDIUM] CWE-79 CVE-2018-12711: An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3. An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.

CVE-2020-24598 [MEDIUM] CWE-601 CVE-2020-24598: An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of co An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect.

CVE-2021-26035 [MEDIUM] CWE-79 CVE-2021-26035: An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of t An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.

CVE-2026-25901 [MEDIUM] CWE-79 CVE-2026-25901: Lack of output escaping leads to a XSS vector in the multilingual associations component. Lack of output escaping leads to a XSS vector in the multilingual associations component.

CVE-2026-30894 [MEDIUM] CWE-79 CVE-2026-30894: Lack of output escaping leads to a XSS vector in the content history component. Lack of output escaping leads to a XSS vector in the content history component.

CVE-2025-63083 [MEDIUM] CWE-79 CVE-2025-63083: Lack of output escaping leads to a XSS vector in the pagebreak plugin. Lack of output escaping leads to a XSS vector in the pagebreak plugin.

CVE-2025-63082 [MEDIUM] CWE-79 CVE-2025-63082: Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img t Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.

CVE-2019-19845 [MEDIUM] CWE-22 CVE-2019-19845: In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure. In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.

CVE-2019-18674 [MEDIUM] CWE-862 CVE-2019-18674: An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping file An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure.

CVE-2020-11891 [MEDIUM] CVE-2020-11891: An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section o An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.

CVE-2020-11889 [MEDIUM] CVE-2020-11889: An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section o An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.

CVE-2026-21631 [MEDIUM] CWE-79 CVE-2026-21631: Lack of output escaping leads to a XSS vector in the multilingual associations component. Lack of output escaping leads to a XSS vector in the multilingual associations component.

CVE-2020-24599 [MEDIUM] CWE-79 CVE-2020-24599: An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS a An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.

CVE-2020-10242 [MEDIUM] CWE-79 CVE-2020-10242: An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protos An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.

CVE-2019-7739 [MEDIUM] CVE-2019-7739: An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child setti An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior. However, it might be unexpected for the user because the configuration dialog lacks an additional message to explain this.