Joomla ! vulnerabilities

CVE-2015-8563 [MEDIUM] CWE-352 CVE-2015-8563: Cross-site request forgery (CSRF) vulnerability in the com_templates component in Joomla! 3.2.0 thro Cross-site request forgery (CSRF) vulnerability in the com_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2017-9934 [MEDIUM] CWE-79 CVE-2017-9934: Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to a Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.

CVE-2021-26034 [MEDIUM] CWE-352 CVE-2021-26034: An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnera An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.

CVE-2020-15695 [MEDIUM] CWE-352 CVE-2020-15695: An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request secti An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.

CVE-2020-15700 [MEDIUM] CWE-352 CVE-2020-15700: An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoin An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability.

CVE-2020-35615 [MEDIUM] CWE-352 CVE-2020-35615: An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport fe An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability.

CVE-2020-11890 [MEDIUM] CWE-20 CVE-2020-11890: An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.

CVE-2023-23750 [MEDIUM] CWE-352 CVE-2023-23750: An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerab An issue was discovered in Joomla! 4.0.0 through 4.2.6. A missing token check causes a CSRF vulnerability in the handling of post-installation messages.

CVE-2026-48954 [MEDIUM] CWE-79 CVE-2026-48954: Improper validation leads to a generic XSS vector in the language override feature. Improper validation leads to a generic XSS vector in the language override feature.

CVE-2026-48905 [MEDIUM] CWE-79 CVE-2026-48905: Lack of input filtering leads to an XSS vector in the HTML filter code. Lack of input filtering leads to an XSS vector in the HTML filter code.

CVE-2008-4122 [HIGH] CWE-319 CVE-2008-4122: Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes i Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVE-2006-4468 [MEDIUM] CWE-20 CVE-2006-4468: Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow a Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to unvalidated input, allow attackers to have an unknown impact via unspecified vectors involving the (1) mosMail, (2) JosIsValidEmail, and (3) josSpoofValue functions; (4) the lack of inclusion of globals.php in administrator/index.php; (5) the Admin User Manager; and (6) the poll

CVE-2018-6380 [MEDIUM] CWE-79 CVE-2018-6380: In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.

CVE-2018-6379 [MEDIUM] CWE-79 CVE-2018-6379: In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.

CVE-2018-12711 [MEDIUM] CWE-79 CVE-2018-12711: An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3. An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.

CVE-2021-26035 [MEDIUM] CWE-79 CVE-2021-26035: An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of t An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.

CVE-2026-48952 [MEDIUM] CWE-79 CVE-2026-48952: Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

CVE-2026-48951 [MEDIUM] CWE-79 CVE-2026-48951: Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

CVE-2026-48953 [MEDIUM] CWE-79 CVE-2026-48953: Lack of escaping leads to an XSS vulnerability in the generic image output layout. Lack of escaping leads to an XSS vulnerability in the generic image output layout.

CVE-2026-25900 [MEDIUM] CWE-79 CVE-2026-25900: Lack of output escaping leads to a XSS vector in the feed modules. Lack of output escaping leads to a XSS vector in the feed modules.