Joomla
Page 2 of 10 — Joomla CVEs from a corpus of 988, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26034 | Medium | 6.5 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sy… |
CVE-2021-26033 | Medium | 6.5 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint. |
CVE-2021-26032 | Medium | 6.1 | 2021-05-26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors. |
CVE-2021-26031 | Medium | 5.3 | 2021-04-14 | An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI. |
CVE-2021-26030 | Medium | 6.1 | 2021-04-14 | An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page |
CVE-2021-26029 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field. |
CVE-2021-26028 | Medium | 5.5 | 2021-03-04 | An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path. |
CVE-2021-26027 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article. |
CVE-2021-23132 | High | 7.5 | 2021-03-04 | An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads |
CVE-2021-23131 | High | 7.5 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager. |
CVE-2021-23130 | Medium | 6.1 | 2021-03-04 | An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues. |
CVE-2021-23129 | Medium | 6.1 | 2021-03-04 | An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues. |
CVE-2021-23128 | Critical | 9.1 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential in… |
CVE-2021-23127 | Critical | 9.1 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes. |
CVE-2021-23126 | Medium | 5.3 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of generating the 2FA secret. |
CVE-2021-23125 | Medium | 6.1 | 2021-01-12 | An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack v… |
CVE-2021-23124 | Medium | 6.1 | 2021-01-12 | An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks. |
CVE-2021-23123 | Medium | 5.3 | 2021-01-12 | An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of com_modules leak names of unpublished and/or i… |
CVE-2020-35616 | High | 7.5 | 2020-12-28 | An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause write ACL violations. |
CVE-2020-35615 | Medium | 6.3 | 2020-12-28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy causes a CSRF vulnerability. |
CVE-2020-35614 | Medium | 5.3 | 2020-12-28 | An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration attack vector in the backend login page. |
CVE-2020-35613 | Critical | 9.8 | 2020-12-28 | An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user lis… |
CVE-2020-35612 | High | 7.5 | 2020-12-28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validation, leading to a path traversal vulnerab… |
CVE-2020-35611 | High | 7.5 | 2020-12-28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the HTML output, disclosing the current va… |
CVE-2020-35610 | High | 7.5 | 2020-12-28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the access level of the corresponding terms. |
CVE-2020-24599 | Medium | 6.1 | 2020-08-26 | An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks. |
CVE-2020-24598 | Medium | 6.1 | 2020-08-26 | An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect. |
CVE-2020-15700 | Medium | 6.3 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability. |
CVE-2020-15699 | Medium | 5.3 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site configuration. |
CVE-2020-15698 | Medium | 5.3 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials |
CVE-2020-15697 | Medium | 4.3 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users. |
CVE-2020-15696 | Medium | 6.1 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image. |
CVE-2020-15695 | Medium | 6.3 | 2020-07-15 | An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability. |
CVE-2020-13763 | High | 7.5 | 2020-06-02 | In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users. |
CVE-2020-13762 | Medium | 6.1 | 2020-06-02 | In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS. |
CVE-2020-13761 | Medium | 6.1 | 2020-06-02 | In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS. |
CVE-2020-13760 | High | 8.8 | 2020-06-02 | In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF. |
CVE-2020-11891 | Medium | 5.3 | 2020-04-21 | An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups. |
CVE-2020-11890 | Medium | 5.3 | 2020-04-21 | An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration. |
CVE-2020-11889 | Medium | 5.3 | 2020-04-21 | An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups. |
CVE-2020-10243 | Critical | 9.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featu… |
CVE-2020-10242 | Medium | 6.1 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks. |
CVE-2020-10241 | High | 8.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF. |
CVE-2020-10240 | Medium | 5.3 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or ema… |
CVE-2020-10239 | High | 8.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users. |
CVE-2020-10238 | High | 7.5 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors. |
CVE-2011-4908 | Critical | 9.8 | 2020-02-12 | TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. |
CVE-2011-4906 | Critical | 9.8 | 2020-02-12 | Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. |
CVE-2011-1151 | Critical | 9.1 | 2020-02-05 | Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters. |
CVE-2011-4912 | Medium | 5.3 | 2020-02-04 | Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass. |
CVE-2011-4937 | High | 7.5 | 2020-02-04 | Joomla! 1.7.1 has core information disclosure due to inadequate error checking. |
CVE-2011-3629 | High | 7.5 | 2020-02-04 | Joomla! core 1.7.1 allows information disclosure due to weak encryption |
CVE-2020-8421 | Medium | 6.1 | 2020-01-28 | An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs. |
CVE-2020-8420 | High | 8.8 | 2020-01-28 | An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability. |
CVE-2020-8419 | High | 8.8 | 2020-01-28 | An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities. |
CVE-2011-3595 | Medium | 5.4 | 2020-01-22 | Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters. |
CVE-2011-4907 | Medium | 5.3 | 2020-01-15 | Joomla! 1.5x through 1.5.12: Missing JEXEC Check |
CVE-2012-1563 | High | 7.5 | 2020-01-15 | Joomla! before 2.5.3 allows Admin Account Creation. |
CVE-2012-1562 | High | 7.5 | 2020-01-15 | Joomla! core before 2.5.3 allows unauthorized password change. |
CVE-2019-19846 | Critical | 9.8 | 2019-12-18 | In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. |
CVE-2019-19845 | Medium | 5.3 | 2019-12-18 | In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure. |
CVE-2019-18674 | Medium | 5.3 | 2019-11-06 | An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure. |
CVE-2019-18650 | High | 8.8 | 2019-11-06 | An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. |
CVE-2019-16725 | Medium | 6.1 | 2019-09-24 | In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates. |
CVE-2019-15028 | Medium | 5.3 | 2019-08-14 | In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms. |
CVE-2019-14654 | High | 8.8 | 2019-08-05 | In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated… |
CVE-2019-12766 | Medium | 6.1 | 2019-06-11 | An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack ve… |
CVE-2019-12765 | Critical | 9.8 | 2019-06-11 | An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection. |
CVE-2019-12764 | Medium | 6.5 | 2019-06-11 | An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users. |
CVE-2019-11809 | Medium | 6.1 | 2019-05-20 | An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack… |
CVE-2019-11831 | Critical | 9.8 | 2019-05-09 | The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows atta… |
CVE-2019-11358 | Medium | 6.1 | 2019-04-20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an… |
CVE-2019-10946 | High | 7.5 | 2019-04-10 | An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access checks, allowing calls from unauthenticated… |
CVE-2019-10945 | Critical | 9.8 | 2019-04-10 | An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside… |
CVE-2019-9714 | Medium | 6.1 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS. |
CVE-2019-9713 | High | 7.5 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access. |
CVE-2019-9712 | Medium | 6.1 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS. |
CVE-2019-9711 | Medium | 6.1 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS. |
CVE-2019-7744 | Medium | 6.1 | 2019-02-12 | An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability. |
CVE-2019-7743 | Critical | 9.8 | 2019-02-12 | An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanis… |
CVE-2019-7742 | Medium | 6.1 | 2019-02-12 | An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side M… |
CVE-2019-7741 | Medium | 6.1 | 2019-02-12 | An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS. |
CVE-2019-7740 | Medium | 6.1 | 2019-02-12 | An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XSS attack vector. |
CVE-2019-7739 | Medium | 6.1 | 2019-02-12 | An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior… |
CVE-2019-6264 | Medium | 6.1 | 2019-01-16 | An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability. |
CVE-2019-6263 | Medium | 4.8 | 2019-01-16 | An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS. |
CVE-2019-6262 | Medium | 5.4 | 2019-01-16 | An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration helpurl settings allowed stored XSS. |
CVE-2019-6261 | Medium | 6.1 | 2019-01-16 | An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability. |
CVE-2018-17859 | Medium | 4.3 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disabled forms. |
CVE-2018-17858 | High | 8.8 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend. |
CVE-2018-17857 | Medium | 4.3 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation. |
CVE-2018-17856 | High | 7.2 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Admini… |
CVE-2018-17855 | High | 8.8 | 2018-10-09 | An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registra… |
CVE-2018-15882 | Critical | 9.8 | 2018-08-29 | An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the upload fi… |
CVE-2018-15881 | High | 7.5 | 2018-08-29 | An issue was discovered in Joomla! before 3.8.12. Inadequate checks regarding disabled fields can lead to an ACL violation. |
CVE-2018-15880 | Medium | 5.4 | 2018-08-29 | An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack. |
CVE-2018-12712 | High | 8.8 | 2018-06-26 | An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP… |
CVE-2018-12711 | Medium | 6.1 | 2018-06-26 | An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might… |
CVE-2018-6378 | Medium | 6.1 | 2018-05-22 | In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager. |
CVE-2018-11328 | Medium | 4.7 | 2018-05-22 | An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI containing a username and password when the Lo… |