Advisories · Technology

Joomla! Project Joomla! CMS.

Every CVE that names Joomla! Project Joomla! CMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-21631 CVE record

CVSS 5.9 Medium

Joomla! Core - [20260303] - XSS vector in com_associations comparison view
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 1 Apr 2026
CVE-2026-21632 CVE record

CVSS 5.9 Medium

Joomla! Core - [20260304] - XSS vectors in various article title outputs
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 1 Apr 2026
CVE-2025-63082 CVE record

CVSS 5.9 Medium

Joomla! Core - [20260101] - Inadequate content filtering for data URLs
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 6 Jan 2026
CVE-2025-63083 CVE record

CVSS 5.9 Medium

Joomla! Core - [20260102] - XSS vector in the pagebreak plugin
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 6 Jan 2026
CVE-2025-54477 CVE record

CVSS 5.3 Medium

Joomla! Core - [20250902] User-Enumeration in passkey authentication method
- Joomla! Project Joomla! CMS
- Information disclosure
Not analysed yet 30 Sept 2025
CVE-2025-22213 CVE record

CVSS 7.1 High

[20250301] - Core - Malicious file uploads via Media Manager
- Joomla! Project Joomla! CMS
- Unrestricted file upload
Not analysed yet 11 Mar 2025
CVE-2025-22207 CVE record

CVSS 6.7 Medium

[20250201] - Core - SQL injection vulnerability in Scheduled Tasks component
- Joomla! Project Joomla! CMS
- SQL injection
Not analysed yet 18 Feb 2025
CVE-2024-40749 CVE record

CVSS 7.5 High

[20250103] - Core - Read ACL violation in multiple core views
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 7 Jan 2025
CVE-2024-40747 CVE record

CVSS 6.1 Medium

[20250101] - Core - XSS vectors in module chromes
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 7 Jan 2025
CVE-2024-40748 CVE record

CVSS 7.5 High

[20250102] - Core - XSS vector in the id attribute of menu lists
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 7 Jan 2025
CVE-2024-27185 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

[20240802] - Core - Cache Poisoning in Pagination
- Joomla! Project Joomla! CMS
- HTTP request smuggling
Not analysed yet 20 Aug 2024
CVE-2024-27186 CVE record

CVSS 6.1 Medium

[20240803] - Core - XSS in HTML Mail Templates
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 20 Aug 2024
CVE-2024-27184 CVE record

CVSS 6.1 Medium

[20240801] - Core - Inadequate validation of internal URLs
- Joomla! Project Joomla! CMS
- Open redirect
Not analysed yet 20 Aug 2024
CVE-2024-40743 CVE record

CVSS 6.1 Medium

[20240805] - Core - XSS vectors in Outputfilter::strip* methods
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 20 Aug 2024
CVE-2024-27187 CVE record

CVSS 7.5 High

[20240804] - Core - Improper ACL for backend profile view
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 20 Aug 2024
CVE-2024-21729 CVE record

CVSS 6.1 Medium

[20240701] - Core - XSS in accessible media selection field
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 9 Jul 2024
CVE-2024-21730 CVE record

CVSS 5.4 Medium

[20240702] - Core - Self-XSS in fancyselect list field layout
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 9 Jul 2024
CVE-2024-26279 CVE record

CVSS 6.1 Medium

[20240704] - Core - XSS in Wrapper extensions
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 9 Jul 2024
CVE-2024-26278 CVE record

CVSS 4.6 Medium

[20240705] - Core - XSS in com_fields default field value
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 9 Jul 2024
CVE-2024-21731 CVE record

CVSS 6.1 Medium

[20240703] - Core - XSS in StringHelper::truncate method
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 9 Jul 2024
CVE-2024-21723 CVE record

CVSS 4.3 Medium

[20240202] - Core - Open redirect in installation application
- Joomla! Project Joomla! CMS
- Open redirect
Not analysed yet 20 Feb 2024
CVE-2024-21725 CVE record

CVSS 6.1 Medium

[20240204] - Core - XSS in mail address outputs
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2024-21724 CVE record

CVSS 6.1 Medium

[20240203] - Core - XSS in media selection fields
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2024-21722 CVE record

CVSS 6.3 Medium

[20240201] - Core - Insufficient session expiration in MFA management views
- Joomla! Project Joomla! CMS
- Authentication bypass
Not analysed yet 20 Feb 2024
CVE-2024-21726 CVE record

CVSS 6.5 Medium

[20240205] - Core - Inadequate content filtering within the filter code
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2023-40626 CVE record

[20231101] - Core - Exposure of environment variables
- Joomla! Project Joomla! CMS
Not analysed yet 29 Nov 2023
CVE-2023-23754 CVE record

CVSS 6.1 Medium

[20230501] - Core - Open Redirect and XSS within the mfa select
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
Not analysed yet 30 May 2023
CVE-2023-23755 CVE record

CVSS 7.5 High

[20230502] - Core - Bruteforce prevention within the mfa screen
- Joomla! Project Joomla! CMS
Not analysed yet 30 May 2023
CVE-2023-23752 CVE record

CVSS 5.3 MediumCritical · KEVKEV

[20230201] - Core - Improper access check in webservice endpoints
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 16 Feb 2023
CVE-2023-23751 CVE record

CVSS 4.3 Medium

[20230102] - Core - Missing ACL checks for com_actionlogs
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 1 Feb 2023
CVE-2023-23750 CVE record

CVSS 6.3 Medium

[20230101] - Core - CSRF within post-installation messages
- Joomla! Project Joomla! CMS
- Cross-site request forgery (CSRF)
Not analysed yet 1 Feb 2023
CVE-2022-27914 CVE record

[20221101] - Core - RXSS through reflection of user input in com_media
- Joomla! Project Joomla! CMS
Not analysed yet 8 Nov 2022
CVE-2022-27913 CVE record

[20221002] - Core - RXSS through reflection of user input in headings
- Joomla! Project Joomla! CMS
Not analysed yet 25 Oct 2022
CVE-2022-27912 CVE record

[20221001] - Core - Debug Mode leaks full request payloads including passwords
- Joomla! Project Joomla! CMS
Not analysed yet 25 Oct 2022
CVE-2022-27911 CVE record

[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'
- Joomla! Project Joomla! CMS
Not analysed yet 31 Aug 2022
CVE-2022-23801 CVE record

[20220309] - Core - XSS attack vector through SVG
- Joomla! Project Joomla! CMS
Not analysed yet 30 Mar 2022
CVE-2022-23798 CVE record

[20220306] - Core - Inadequate validation of internal URLs
- Joomla! Project Joomla! CMS
Not analysed yet 30 Mar 2022
CVE-2022-23797 CVE record

[20220305] - Core - Inadequate filtering on the selected Ids
- Joomla! Project Joomla! CMS
Not analysed yet 30 Mar 2022
CVE-2022-23796 CVE record

[20220304] - Core - Missing input validation within com_fields class inputs
- Joomla! Project Joomla! CMS
Not analysed yet 30 Mar 2022
CVE-2022-23795 CVE record

[20220303] - Core - User row are not bound to a authentication mechanism
- Joomla! Project Joomla! CMS
Not analysed yet 30 Mar 2022
CVE-2021-26040 CVE record

[20210801] - Core - Insufficient access control for com_media deletion endpoint
- Joomla! Project Joomla! CMS
Not analysed yet 24 Aug 2021
CVE-2021-26039 CVE record

[20210705] - Core - XSS in com_media imagelist
- Joomla! Project Joomla! CMS
Not analysed yet 7 Jul 2021
CVE-2021-26038 CVE record

[20210704] - Core - Privilege escalation through com_installer
- Joomla! Project Joomla! CMS
Not analysed yet 7 Jul 2021
CVE-2021-26037 CVE record

[20210703] - Core - Lack of enforced session termination
- Joomla! Project Joomla! CMS
Not analysed yet 7 Jul 2021
CVE-2021-26036 CVE record

[20210702] - Core - DoS through usergroup table manipulation
- Joomla! Project Joomla! CMS
Not analysed yet 7 Jul 2021
CVE-2021-26035 CVE record

[20210701] - Core - XSS in JForm Rules field
- Joomla! Project Joomla! CMS
Not analysed yet 7 Jul 2021
CVE-2021-26034 CVE record

[20210503] - Core - CSRF in data download endpoints
- Joomla! Project Joomla! CMS
Not analysed yet 26 May 2021
CVE-2021-26033 CVE record

[20210502] - Core - CSRF in AJAX reordering endpoint
- Joomla! Project Joomla! CMS
Not analysed yet 26 May 2021
CVE-2021-26032 CVE record

[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload
- Joomla! Project Joomla! CMS
Not analysed yet 26 May 2021
CVE-2021-26031 CVE record

[20210402] - Core - Inadequate filters on module layout settings
- Joomla! Project Joomla! CMS
Not analysed yet 14 Apr 2021
CVE-2021-26030 CVE record

[20210401] - Core - Escape xss in logo parameter error pages
- Joomla! Project Joomla! CMS
Not analysed yet 14 Apr 2021
CVE-2021-26029 CVE record

[20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021
CVE-2021-26027 CVE record

[20210307] - Core - ACL violation within com_content frontend editing
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021
CVE-2021-23132 CVE record

[20210306] - Core - com_media allowed paths that are not intended for image uploads
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021
CVE-2021-23131 CVE record

[20210305] - Core - Input validation within the template manager
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021
CVE-2021-23130 CVE record

[20210304] - Core - XSS within the feed parser library
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021
CVE-2021-23129 CVE record

[20210303] - Core - XSS within alert messages showed to users
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021
CVE-2021-23128 CVE record

[20210302] - Core - Potential Insecure FOFEncryptRandval
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021
CVE-2021-23127 CVE record

[20210301] - Core - Insecure randomness within 2FA secret generation
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021
CVE-2021-23126 CVE record

[20210301] - Core - Insecure randomness within 2FA secret generation
- Joomla! Project Joomla! CMS
Not analysed yet 4 Mar 2021