Latest vulnerabilities for vendor "joomla"

4.7

First published (updated )

CVE-2025-22209

Admiror GalleryExtension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomla

7.5

First published (updated )

CVE-2025-22205

Regular Labs SourcererExtension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for Joomla

9.8

First published (updated )

CVE-2025-22204

Joomla[20240701] - Core - XSS in accessible media selection field

6.1

First published (updated )

CVE-2024-21729

Joomla[20240702] - Core - Self-XSS in fancyselect list field layout

5.4

First published (updated )

CVE-2024-21730

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Joomla[20240704] - Core - XSS in Wrapper extensions

6.1

First published (updated )

CVE-2024-26279

Joomla[20240705] - Core - XSS in com_fields default field value

6.1

First published (updated )

CVE-2024-26278

Joomla[20240703] - Core - XSS in StringHelper::truncate method

6.1

First published (updated )

CVE-2024-21731

Joomla[20240203] - Core - XSS in media selection fields

6.1

First published (updated )

CVE-2024-21724

Joomla[20231101] - Core - Exposure of environment variables

7.5

First published (updated )

CVE-2023-40626

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Joomla[20230501] - Core - Open Redirect and XSS within the mfa select

6.1

First published (updated )

CVE-2023-23754

Joomla[20230502] - Core - Bruteforce prevention within the mfa screen

7.5

First published (updated )

CVE-2023-23755

Joomla[20230201] - Core - Improper access check in webservice endpoints

5.3

Exploited

First published (updated )

CVE-2023-23752

Joomla[20230102] - Core - Missing ACL checks for com_actionlogs

4.3

First published (updated )

CVE-2023-23751

Joomla[20230101] - Core - CSRF within post-installation messages

6.3

First published (updated )

CVE-2023-23750

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Joomla[20221101] - Core - RXSS through reflection of user input in com_media

6.1

First published (updated )

CVE-2022-27914

Joomla[20221002] - Core - RXSS through reflection of user input in headings

6.1

First published (updated )

CVE-2022-27913

Joomla[20221001] - Core - Debug Mode leaks full request payloads including passwords

5.3

First published (updated )

CVE-2022-27912

Joomla[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'

5.3

First published (updated )

CVE-2022-27911

Joomla[20220309] - Core - XSS attack vector through SVG

6.1

First published (updated )

CVE-2022-23801

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Joomla[20220306] - Core - Inadequate validation of internal URLs

6.1

First published (updated )

CVE-2022-23798

Joomla[20220304] - Core - Missing input validation within com_fields class inputs

6.1

First published (updated )

CVE-2022-23796

Joomla[20220303] - Core - User row are not bound to a authentication mechanism

9.8

First published (updated )

CVE-2022-23795

composer/joomla/filter[20220308] - Core - Inadequate content filtering within the filter code

6.1

First published (updated )

CVE-2022-23800

composer/joomla/filesystem[20220302] - Core - Path Disclosure within filesystem error messages

5.3

First published (updated )

CVE-2022-23794

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

composer/joomla/input[20220307] - Core - Variable Tampering on JInput $_REQUEST data

9.8

First published (updated )

CVE-2022-23799

composer/joomla/archive[20220301] - Core - Zip Slip within the Tar extractor

7.5

First published (updated )

CVE-2022-23793

Joomla[20220305] - Core - Inadequate filtering on the selected Ids

9.8

First published (updated )

CVE-2022-23797

Joomla[20210801] - Core - Insufficient access control for com_media deletion endpoint

9.1

First published (updated )

CVE-2021-26040

Joomla[20210705] - Core - XSS in com_media imagelist

6.1

First published (updated )

CVE-2021-26039

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.