Joomla Joomla\!
643 CVEs affecting Joomla Joomla\!. Latest disclosed: 2026-07-07. Critical: 37, High: 58.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48904 | Critical | 9.8 | 2026-05-26 | An improper access check allows privelege escalation through the com_users group editing webservice endpoint. |
CVE-2026-48902 | Critical | 9.8 | 2026-05-26 | The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. |
CVE-2026-48899 | Critical | 9.8 | 2026-05-26 | An improper access check allows privilege escalation through the com_users batch task. |
CVE-2026-48898 | Critical | 9.8 | 2026-05-26 | An improper access check allows privilege escalation through the com_users batch task. |
CVE-2026-40383 | Critical | 9.8 | 2026-05-26 | An improper validation of user-supplied input leads to a local file inclusion vulnerability. |
CVE-2026-35223 | Critical | 9.8 | 2026-05-26 | An improper access check allows unauthorized access to com_config webservice endpoints. |
CVE-2026-35222 | Critical | 9.8 | 2026-05-26 | Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. |
CVE-2026-35221 | Critical | 9.8 | 2026-05-26 | Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. |
CVE-2025-25226 | Critical | 9.8 | 2025-04-08 | Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is… |
CVE-2022-23799 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data. |
CVE-2022-23797 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an po… |
CVE-2022-23795 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could unde… |
CVE-2010-1435 | Critical | 9.8 | 2021-06-21 | Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently re… |
CVE-2010-1433 | Critical | 9.8 | 2021-06-21 | Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An at… |
CVE-2020-35613 | Critical | 9.8 | 2020-12-28 | An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user lis… |
CVE-2020-10243 | Critical | 9.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featu… |
CVE-2019-19846 | Critical | 9.8 | 2019-12-18 | In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. |
CVE-2019-12765 | Critical | 9.8 | 2019-06-11 | An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection. |
CVE-2019-11831 | Critical | 9.8 | 2019-05-09 | The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows atta… |
CVE-2019-10945 | Critical | 9.8 | 2019-04-10 | An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside… |