# Joomla! Project Joomla! CMS.

Every CVE that names Joomla! Project Joomla! CMS among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Joomla! Core - \[20260303\] - XSS vector in com_associations comparison view](https://agentprime.io/advisories/CVE-2026-21631.md)
  `CVE-2026-21631` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260304\] - XSS vectors in various article title outputs](https://agentprime.io/advisories/CVE-2026-21632.md)
  `CVE-2026-21632` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260101\] - Inadequate content filtering for data URLs](https://agentprime.io/advisories/CVE-2025-63082.md)
  `CVE-2025-63082` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260102\] - XSS vector in the pagebreak plugin](https://agentprime.io/advisories/CVE-2025-63083.md)
  `CVE-2025-63083` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20250902\] User-Enumeration in passkey authentication method](https://agentprime.io/advisories/CVE-2025-54477.md)
  `CVE-2025-54477` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Information disclosure
- [\[20250301\] - Core - Malicious file uploads via Media Manager](https://agentprime.io/advisories/CVE-2025-22213.md)
  `CVE-2025-22213` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.1 High · Not analysed yet · Published 11 Mar 2025 · Tags: Unrestricted file upload
- [\[20250201\] - Core - SQL injection vulnerability in Scheduled Tasks component](https://agentprime.io/advisories/CVE-2025-22207.md)
  `CVE-2025-22207` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.7 Medium · Not analysed yet · Published 18 Feb 2025 · Tags: SQL injection
- [\[20250103\] - Core - Read ACL violation in multiple core views](https://agentprime.io/advisories/CVE-2024-40749.md)
  `CVE-2024-40749` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.5 High · Not analysed yet · Published 7 Jan 2025 · Tags: Broken access control
- [\[20250101\] - Core - XSS vectors in module chromes](https://agentprime.io/advisories/CVE-2024-40747.md)
  `CVE-2024-40747` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 7 Jan 2025 · Tags: Cross-site scripting (XSS)
- [\[20250102\] - Core - XSS vector in the id attribute of menu lists](https://agentprime.io/advisories/CVE-2024-40748.md)
  `CVE-2024-40748` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.5 High · Not analysed yet · Published 7 Jan 2025 · Tags: Cross-site scripting (XSS)
- [\[20240802\] - Core - Cache Poisoning in Pagination](https://agentprime.io/advisories/CVE-2024-27185.md)
  `CVE-2024-27185` · CVE record: Joomla! Project Joomla! CMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2024 · Tags: HTTP request smuggling
- [\[20240803\] - Core - XSS in HTML Mail Templates](https://agentprime.io/advisories/CVE-2024-27186.md)
  `CVE-2024-27186` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Cross-site scripting (XSS)
- [\[20240801\] - Core - Inadequate validation of internal URLs](https://agentprime.io/advisories/CVE-2024-27184.md)
  `CVE-2024-27184` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Open redirect
- [\[20240805\] - Core - XSS vectors in Outputfilter::strip\* methods](https://agentprime.io/advisories/CVE-2024-40743.md)
  `CVE-2024-40743` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Cross-site scripting (XSS)
- [\[20240804\] - Core - Improper ACL for backend profile view](https://agentprime.io/advisories/CVE-2024-27187.md)
  `CVE-2024-27187` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2024 · Tags: Broken access control
- [\[20240701\] - Core - XSS in accessible media selection field](https://agentprime.io/advisories/CVE-2024-21729.md)
  `CVE-2024-21729` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Cross-site scripting (XSS)
- [\[20240702\] - Core - Self-XSS in fancyselect list field layout](https://agentprime.io/advisories/CVE-2024-21730.md)
  `CVE-2024-21730` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.4 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Cross-site scripting (XSS)
- [\[20240704\] - Core - XSS in Wrapper extensions](https://agentprime.io/advisories/CVE-2024-26279.md)
  `CVE-2024-26279` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Cross-site scripting (XSS)
- [\[20240705\] - Core - XSS in com_fields default field value](https://agentprime.io/advisories/CVE-2024-26278.md)
  `CVE-2024-26278` · CVE record: Joomla! Project Joomla! CMS · CVSS 4.6 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Cross-site scripting (XSS)
- [\[20240703\] - Core - XSS in StringHelper::truncate method](https://agentprime.io/advisories/CVE-2024-21731.md)
  `CVE-2024-21731` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Cross-site scripting (XSS)
- [\[20240202\] - Core - Open redirect in installation application](https://agentprime.io/advisories/CVE-2024-21723.md)
  `CVE-2024-21723` · CVE record: Joomla! Project Joomla! CMS · CVSS 4.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Open redirect
- [\[20240204\] - Core - XSS in mail address outputs](https://agentprime.io/advisories/CVE-2024-21725.md)
  `CVE-2024-21725` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · EPSS 0.27 · Not analysed yet · Published 20 Feb 2024 · Tags: Cross-site scripting (XSS)
- [\[20240203\] - Core - XSS in media selection fields](https://agentprime.io/advisories/CVE-2024-21724.md)
  `CVE-2024-21724` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Cross-site scripting (XSS)
- [\[20240201\] - Core - Insufficient session expiration in MFA management views](https://agentprime.io/advisories/CVE-2024-21722.md)
  `CVE-2024-21722` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Authentication bypass
- [\[20240205\] - Core - Inadequate content filtering within the filter code](https://agentprime.io/advisories/CVE-2024-21726.md)
  `CVE-2024-21726` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.5 Medium · EPSS 0.49 · Not analysed yet · Published 20 Feb 2024 · Tags: Cross-site scripting (XSS)
- [\[20231101\] - Core - Exposure of environment variables](https://agentprime.io/advisories/CVE-2023-40626.md)
  `CVE-2023-40626` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 29 Nov 2023
- [\[20230501\] - Core - Open Redirect and XSS within the mfa select](https://agentprime.io/advisories/CVE-2023-23754.md)
  `CVE-2023-23754` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.1 Medium · Not analysed yet · Published 30 May 2023 · Tags: Cross-site scripting (XSS)
- [\[20230502\] - Core - Bruteforce prevention within the mfa screen](https://agentprime.io/advisories/CVE-2023-23755.md)
  `CVE-2023-23755` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.5 High · Not analysed yet · Published 30 May 2023
- [\[20230201\] - Core - Improper access check in webservice endpoints](https://agentprime.io/advisories/CVE-2023-23752.md)
  `CVE-2023-23752` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 16 Feb 2023 · Tags: Broken access control
- [\[20230102\] - Core - Missing ACL checks for com_actionlogs](https://agentprime.io/advisories/CVE-2023-23751.md)
  `CVE-2023-23751` · CVE record: Joomla! Project Joomla! CMS · CVSS 4.3 Medium · Not analysed yet · Published 1 Feb 2023 · Tags: Broken access control
- [\[20230101\] - Core - CSRF within post-installation messages](https://agentprime.io/advisories/CVE-2023-23750.md)
  `CVE-2023-23750` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.3 Medium · Not analysed yet · Published 1 Feb 2023 · Tags: Cross-site request forgery (CSRF)
- [\[20221101\] - Core - RXSS through reflection of user input in com_media](https://agentprime.io/advisories/CVE-2022-27914.md)
  `CVE-2022-27914` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 8 Nov 2022
- [\[20221002\] - Core - RXSS through reflection of user input in headings](https://agentprime.io/advisories/CVE-2022-27913.md)
  `CVE-2022-27913` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 25 Oct 2022
- [\[20221001\] - Core - Debug Mode leaks full request payloads including passwords](https://agentprime.io/advisories/CVE-2022-27912.md)
  `CVE-2022-27912` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 25 Oct 2022
- [\[20220801\] - Core - Multiple Full Path Disclosures because of missing '\_JEXEC or die check'](https://agentprime.io/advisories/CVE-2022-27911.md)
  `CVE-2022-27911` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 31 Aug 2022
- [\[20220309\] - Core - XSS attack vector through SVG](https://agentprime.io/advisories/CVE-2022-23801.md)
  `CVE-2022-23801` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 30 Mar 2022
- [\[20220306\] - Core - Inadequate validation of internal URLs](https://agentprime.io/advisories/CVE-2022-23798.md)
  `CVE-2022-23798` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 30 Mar 2022
- [\[20220305\] - Core - Inadequate filtering on the selected Ids](https://agentprime.io/advisories/CVE-2022-23797.md)
  `CVE-2022-23797` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 30 Mar 2022
- [\[20220304\] - Core - Missing input validation within com_fields class inputs](https://agentprime.io/advisories/CVE-2022-23796.md)
  `CVE-2022-23796` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 30 Mar 2022
- [\[20220303\] - Core - User row are not bound to a authentication mechanism](https://agentprime.io/advisories/CVE-2022-23795.md)
  `CVE-2022-23795` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 30 Mar 2022
- [\[20210801\] - Core - Insufficient access control for com_media deletion endpoint](https://agentprime.io/advisories/CVE-2021-26040.md)
  `CVE-2021-26040` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 24 Aug 2021
- [\[20210705\] - Core - XSS in com_media imagelist](https://agentprime.io/advisories/CVE-2021-26039.md)
  `CVE-2021-26039` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 7 Jul 2021
- [\[20210704\] - Core - Privilege escalation through com_installer](https://agentprime.io/advisories/CVE-2021-26038.md)
  `CVE-2021-26038` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 7 Jul 2021
- [\[20210703\] - Core - Lack of enforced session termination](https://agentprime.io/advisories/CVE-2021-26037.md)
  `CVE-2021-26037` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 7 Jul 2021
- [\[20210702\] - Core - DoS through usergroup table manipulation](https://agentprime.io/advisories/CVE-2021-26036.md)
  `CVE-2021-26036` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 7 Jul 2021
- [\[20210701\] - Core - XSS in JForm Rules field](https://agentprime.io/advisories/CVE-2021-26035.md)
  `CVE-2021-26035` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 7 Jul 2021
- [\[20210503\] - Core - CSRF in data download endpoints](https://agentprime.io/advisories/CVE-2021-26034.md)
  `CVE-2021-26034` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 26 May 2021
- [\[20210502\] - Core - CSRF in AJAX reordering endpoint](https://agentprime.io/advisories/CVE-2021-26033.md)
  `CVE-2021-26033` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 26 May 2021
- [\[20210501\] - Core - Adding HTML to the executable block list of MediaHelper::canUpload](https://agentprime.io/advisories/CVE-2021-26032.md)
  `CVE-2021-26032` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 26 May 2021
- [\[20210402\] - Core - Inadequate filters on module layout settings](https://agentprime.io/advisories/CVE-2021-26031.md)
  `CVE-2021-26031` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 14 Apr 2021
- [\[20210401\] - Core - Escape xss in logo parameter error pages](https://agentprime.io/advisories/CVE-2021-26030.md)
  `CVE-2021-26030` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · EPSS 0.83 · Not analysed yet · Published 14 Apr 2021
- [\[20210309\] - Core - Inadequate filtering of form contents could allow to overwrite the author field](https://agentprime.io/advisories/CVE-2021-26029.md)
  `CVE-2021-26029` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021
- [\[20210307\] - Core - ACL violation within com_content frontend editing](https://agentprime.io/advisories/CVE-2021-26027.md)
  `CVE-2021-26027` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021
- [\[20210306\] - Core - com_media allowed paths that are not intended for image uploads](https://agentprime.io/advisories/CVE-2021-23132.md)
  `CVE-2021-23132` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021
- [\[20210305\] - Core - Input validation within the template manager](https://agentprime.io/advisories/CVE-2021-23131.md)
  `CVE-2021-23131` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021
- [\[20210304\] - Core - XSS within the feed parser library](https://agentprime.io/advisories/CVE-2021-23130.md)
  `CVE-2021-23130` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021
- [\[20210303\] - Core - XSS within alert messages showed to users](https://agentprime.io/advisories/CVE-2021-23129.md)
  `CVE-2021-23129` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021
- [\[20210302\] - Core - Potential Insecure FOFEncryptRandval](https://agentprime.io/advisories/CVE-2021-23128.md)
  `CVE-2021-23128` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021
- [\[20210301\] - Core - Insecure randomness within 2FA secret generation](https://agentprime.io/advisories/CVE-2021-23127.md)
  `CVE-2021-23127` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021
- [\[20210301\] - Core - Insecure randomness within 2FA secret generation](https://agentprime.io/advisories/CVE-2021-23126.md)
  `CVE-2021-23126` · CVE record: Joomla! Project Joomla! CMS · No CVSS score · Not analysed yet · Published 4 Mar 2021

Newest: <https://agentprime.io/advisories/technology/joomla-project-joomla-cms.md>
Older: <https://agentprime.io/advisories/technology/joomla-project-joomla-cms.md?cursor=WyIyMDIxLTAzLTA0VDE3OjM3OjE0LjI2MjAwMFoiLCJDVkUtMjAyMS0yMzEyNiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=joomla-project-joomla-cms&cursor=WyIyMDI2LTA0LTAxVDA5OjAzOjE4LjU2MzAwMFoiLCJDVkUtMjAyNi0yMzg5OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/joomla-project-joomla-cms/?cursor=WyIyMDI2LTA0LTAxVDA5OjAzOjE4LjU2MzAwMFoiLCJDVkUtMjAyNi0yMzg5OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.