# cve.now: Joomla! Project

The newest entries naming Joomla! Project as an affected vendor (up to 200), of 140 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-90915](https://cve.now/CVE-2026-90915.md): Joomla! Core - \[20260905\] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.0)
- [CVE-2026-92226](https://cve.now/CVE-2026-92226.md): Joomla! Core - \[20260913\] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.0)
- [CVE-2026-92224](https://cve.now/CVE-2026-92224.md): Joomla! Core - \[20260911\] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.9)
- [CVE-2026-90907](https://cve.now/CVE-2026-90907.md): Joomla! Core - \[20260902\] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (CVSS 6.9)
- [CVE-2026-90914](https://cve.now/CVE-2026-90914.md): Joomla! Core - \[20260904\] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.9)
- [CVE-2026-92231](https://cve.now/CVE-2026-92231.md): Joomla! Core - \[20260915\] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.1)
- [CVE-2026-90918](https://cve.now/CVE-2026-90918.md): Joomla! Core - \[20260908\] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 6.9)
- [CVE-2026-92222](https://cve.now/CVE-2026-92222.md): Joomla! Core - \[20260909\] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 8.9)
- [CVE-2026-92223](https://cve.now/CVE-2026-92223.md): Joomla! Core - \[20260910\] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.1)
- [CVE-2026-90917](https://cve.now/CVE-2026-90917.md): Joomla! Core - \[20260907\] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 6.9)
- [CVE-2026-92225](https://cve.now/CVE-2026-92225.md): Joomla! Core - \[20260912\] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.9)
- [CVE-2026-92227](https://cve.now/CVE-2026-92227.md): Joomla! Core - \[20260914\] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 8.2)
- [CVE-2026-92232](https://cve.now/CVE-2026-92232.md): Joomla! Core - \[20260916\] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.1)
- [CVE-2026-90916](https://cve.now/CVE-2026-90916.md): Joomla! Core - \[20260906\] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.1)
- [CVE-2026-90913](https://cve.now/CVE-2026-90913.md): Joomla! Core - \[20260903\] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (CVSS 7.0)
- [CVE-2026-90906](https://cve.now/CVE-2026-90906.md): Joomla! Core - \[20260901\] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (CVSS 5.9)
- [CVE-2026-71573](https://cve.now/CVE-2026-71573.md): Joomla! Core - \[20260802\] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 (CVSS 6.9)
- [CVE-2026-72531](https://cve.now/CVE-2026-72531.md): Joomla! Core - \[20260804\] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 (CVSS 5.1)
- [CVE-2026-73336](https://cve.now/CVE-2026-73336.md): Joomla! Core - \[20260806\] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 (CVSS 5.1)
- [CVE-2026-73372](https://cve.now/CVE-2026-73372.md): Joomla! Core - \[20260809\] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 (CVSS 5.1)
- [CVE-2026-71572](https://cve.now/CVE-2026-71572.md): Joomla! Core - \[20260801\] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 (CVSS 4.8)
- [CVE-2026-73337](https://cve.now/CVE-2026-73337.md): Joomla! Core - \[20260807\] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 (CVSS 8.2)
- [CVE-2026-73371](https://cve.now/CVE-2026-73371.md): Joomla! Core - \[20260808\] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 (CVSS 5.1)
- [CVE-2026-72532](https://cve.now/CVE-2026-72532.md): Joomla! Core - \[20260805\] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 (CVSS 5.1)
- [CVE-2026-73373](https://cve.now/CVE-2026-73373.md): Joomla! Core - \[20260810\] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 (CVSS 8.9)
- [CVE-2026-71574](https://cve.now/CVE-2026-71574.md): Joomla! Core - \[20260803\] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 (CVSS 8.5)
- [CVE-2026-48952](https://cve.now/CVE-2026-48952.md): Joomla! Core - \[20260706\] - XSS in com\_installer (CVSS 5.9)
- [CVE-2026-48947](https://cve.now/CVE-2026-48947.md): Joomla! Core - \[20260701\] - Incorrect Access Control in com\_media webservice endpoints (CVSS 6.4)
- [CVE-2026-48958](https://cve.now/CVE-2026-48958.md): Joomla! Core - \[20260712\] - Incorrect Access Control in com\_fields webservice endpoints (CVSS 6.4)
- [CVE-2026-48950](https://cve.now/CVE-2026-48950.md): Joomla! Core - \[20260704\] - XSS in com\_templates (CVSS 5.9)
- [CVE-2026-48955](https://cve.now/CVE-2026-48955.md): Joomla! Core - \[20260709\] - Incorrect Access Control in com\_workflow (CVSS 6.4)
- [CVE-2026-48956](https://cve.now/CVE-2026-48956.md): Joomla! Core - \[20260710\] - Incorrect Access Control in com\_modules (CVSS 6.4)
- [CVE-2026-48957](https://cve.now/CVE-2026-48957.md): Joomla! Core - \[20260711\] - Incorrect Access Control in com\_privacy webservice endpoints (CVSS 6.4)
- [CVE-2026-48951](https://cve.now/CVE-2026-48951.md): Joomla! Core - \[20260705\] - XSS in various modalreturn layouts (CVSS 5.9)
- [CVE-2026-48953](https://cve.now/CVE-2026-48953.md): Joomla! Core - \[20260707\] - XSS in the generic image output layout (CVSS 5.9)
- [CVE-2026-48948](https://cve.now/CVE-2026-48948.md): Joomla! Core - \[20260702\] - Incorrect Access Control in com\_contact vcf download (CVSS 6.4)
- [CVE-2026-48949](https://cve.now/CVE-2026-48949.md): Joomla! Core - \[20260703\] - XSS in MFA method management (CVSS 5.9)
- [CVE-2026-48954](https://cve.now/CVE-2026-48954.md): Joomla! Core - \[20260708\] - XSS through language overrides (CVSS 5.9)
- [CVE-2026-35221](https://cve.now/CVE-2026-35221.md): Joomla! Core - \[20260506\] - Authenticated blind SQLi in com\_finder (CVSS 6.9)
- [CVE-2026-48903](https://cve.now/CVE-2026-48903.md): Joomla! Framework - \[20260519\] - Inadequate content filtering within the checkAttribute filter code. (CVSS 6.9)
- [CVE-2026-48896](https://cve.now/CVE-2026-48896.md): Joomla! Core - \[20260511\] - MFA Authentication Bypass (CVSS 8.2)
- [CVE-2026-35220](https://cve.now/CVE-2026-35220.md): Joomla! Core - \[20260505\] - CSRF in user activation endpoint (CVSS 4.6)
- [CVE-2026-40383](https://cve.now/CVE-2026-40383.md): Joomla! Core - \[20260509\] - LFI in HTMLView layout parameter (CVSS 7.5)
- [CVE-2026-35222](https://cve.now/CVE-2026-35222.md): Joomla! Core - \[20260507\] - Authenticated blind SQLi in com\_tags (CVSS 6.9)
- [CVE-2026-40384](https://cve.now/CVE-2026-40384.md): Joomla! Core - \[20260510\] - Path traversal in com\_media webservice endpoint (CVSS 5.9)
- [CVE-2026-48905](https://cve.now/CVE-2026-48905.md): Joomla! Framework - \[20260520\] - Inadequate content filtering within the cleanAttributes filter code. (CVSS 6.9)
- [CVE-2026-48897](https://cve.now/CVE-2026-48897.md): Joomla! Core - \[20260512\] - MFA Authentication Bypass (CVSS 8.2)
- [CVE-2026-25901](https://cve.now/CVE-2026-25901.md): Joomla! Core - \[20260502\] - XSS in com\_associations (CVSS 6.9)
- [CVE-2026-48899](https://cve.now/CVE-2026-48899.md): Joomla! Core - \[20260515\] - Incorrect Access Control in sample data plugins (CVSS 5.3)
- [CVE-2026-48900](https://cve.now/CVE-2026-48900.md): Joomla! Core - \[20260516\] - Incorrect Access Control in com\_scheduler (CVSS 6.4)
- [CVE-2026-48902](https://cve.now/CVE-2026-48902.md): Joomla! Core - \[20260518\] - Transport encryption downgrade for password and username reset links (CVSS 9.8)
- [CVE-2026-35223](https://cve.now/CVE-2026-35223.md): Joomla! Core - \[20260508\] - Improper access check in com\_config webservice endpoints (CVSS 8.6)
- [CVE-2026-25900](https://cve.now/CVE-2026-25900.md): Joomla! Core - \[20260501\] - XSS in feed modules (CVSS 6.9)
- [CVE-2026-48904](https://cve.now/CVE-2026-48904.md): Joomla! Core - \[20260514\] - Privilege escalation through com\_users webservice endpoints (CVSS 8.2)
- [CVE-2026-30895](https://cve.now/CVE-2026-30895.md): Joomla! Core - \[20260504\] - XSS in readmore links (CVSS 6.9)
- [CVE-2026-48898](https://cve.now/CVE-2026-48898.md): Joomla! Core - \[20260513\] - Privilege escalation through com\_users batch task (CVSS 8.2)
- [CVE-2026-30894](https://cve.now/CVE-2026-30894.md): Joomla! Core - \[20260503\] - XSS in com\_contenthistory (CVSS 6.9)
- [CVE-2026-48901](https://cve.now/CVE-2026-48901.md): Joomla! Core - \[20260517\] - Incorrect Cache Key Construction for InputFilter objects (CVSS 7.5)
- [CVE-2026-21630](https://cve.now/CVE-2026-21630.md): Joomla! Core - \[20260302\] - SQL injection in com\_content articles webservice endpoint (CVSS 6.9)
- [CVE-2026-23898](https://cve.now/CVE-2026-23898.md): Joomla! Core - \[20260305\] - Arbitrary file deletion in com\_joomlaupdate (CVSS 8.6)
- [CVE-2026-21629](https://cve.now/CVE-2026-21629.md): Joomla! Core - \[20260301\] - ACL hardening in com\_ajax (CVSS 6.3)
- [CVE-2026-23899](https://cve.now/CVE-2026-23899.md): Joomla! Core - \[20260306\] - Improper access check in webservice endpoints (CVSS 8.6)
- [CVE-2026-21631](https://cve.now/CVE-2026-21631.md): Joomla! Core - \[20260303\] - XSS vector in com\_associations comparison view (CVSS 5.9)
- [CVE-2026-21632](https://cve.now/CVE-2026-21632.md): Joomla! Core - \[20260304\] - XSS vectors in various article title outputs (CVSS 5.9)
- [CVE-2025-63082](https://cve.now/CVE-2025-63082.md): Joomla! Core - \[20260101\] - Inadequate content filtering for data URLs (CVSS 5.9)
- [CVE-2025-63083](https://cve.now/CVE-2025-63083.md): Joomla! Core - \[20260102\] - XSS vector in the pagebreak plugin (CVSS 5.9)
- [CVE-2025-54477](https://cve.now/CVE-2025-54477.md): Joomla! Core - \[20250902\] User-Enumeration in passkey authentication method (CVSS 5.3)
- [CVE-2025-54476](https://cve.now/CVE-2025-54476.md): Joomla! Core - \[20250901\] Inadequate content filtering within the checkAttribute filter code (CVSS 4.8)
- [CVE-2025-25226](https://cve.now/CVE-2025-25226.md): \[20250401\] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package (CVSS 9.8)
- [CVE-2025-25227](https://cve.now/CVE-2025-25227.md): \[20250402\] - Joomla Core - MFA Authentication Bypass (CVSS 7.5)
- [CVE-2025-22213](https://cve.now/CVE-2025-22213.md): \[20250301\] - Core - Malicious file uploads via Media Manager (CVSS 7.1)
- [CVE-2025-22207](https://cve.now/CVE-2025-22207.md): \[20250201\] - Core - SQL injection vulnerability in Scheduled Tasks component (CVSS 6.7)
- [CVE-2024-40749](https://cve.now/CVE-2024-40749.md): \[20250103\] - Core - Read ACL violation in multiple core views (CVSS 7.5)
- [CVE-2024-40747](https://cve.now/CVE-2024-40747.md): \[20250101\] - Core - XSS vectors in module chromes (CVSS 6.1)
- [CVE-2024-40748](https://cve.now/CVE-2024-40748.md): \[20250102\] - Core - XSS vector in the id attribute of menu lists (CVSS 7.5)
- [CVE-2024-27185](https://cve.now/CVE-2024-27185.md): \[20240802\] - Core - Cache Poisoning in Pagination (CVSS 9.1)
- [CVE-2024-27186](https://cve.now/CVE-2024-27186.md): \[20240803\] - Core - XSS in HTML Mail Templates (CVSS 6.1)
- [CVE-2024-27184](https://cve.now/CVE-2024-27184.md): \[20240801\] - Core - Inadequate validation of internal URLs (CVSS 6.1)
- [CVE-2024-40743](https://cve.now/CVE-2024-40743.md): \[20240805\] - Core - XSS vectors in Outputfilter::strip\* methods (CVSS 6.1)
- [CVE-2024-27187](https://cve.now/CVE-2024-27187.md): \[20240804\] - Core - Improper ACL for backend profile view (CVSS 7.5)
- [CVE-2024-21729](https://cve.now/CVE-2024-21729.md): \[20240701\] - Core - XSS in accessible media selection field (CVSS 6.1)
- [CVE-2024-21730](https://cve.now/CVE-2024-21730.md): \[20240702\] - Core - Self-XSS in fancyselect list field layout (CVSS 5.4)
- [CVE-2024-26279](https://cve.now/CVE-2024-26279.md): \[20240704\] - Core - XSS in Wrapper extensions (CVSS 6.1)
- [CVE-2024-26278](https://cve.now/CVE-2024-26278.md): \[20240705\] - Core - XSS in com\_fields default field value (CVSS 4.6)
- [CVE-2024-21731](https://cve.now/CVE-2024-21731.md): \[20240703\] - Core - XSS in StringHelper::truncate method (CVSS 6.1)
- [CVE-2024-21723](https://cve.now/CVE-2024-21723.md): \[20240202\] - Core - Open redirect in installation application (CVSS 4.3)
- [CVE-2024-21725](https://cve.now/CVE-2024-21725.md): \[20240204\] - Core - XSS in mail address outputs (CVSS 6.1)
- [CVE-2024-21724](https://cve.now/CVE-2024-21724.md): \[20240203\] - Core - XSS in media selection fields (CVSS 6.1)
- [CVE-2024-21722](https://cve.now/CVE-2024-21722.md): \[20240201\] - Core - Insufficient session expiration in MFA management views (CVSS 6.3)
- [CVE-2024-21726](https://cve.now/CVE-2024-21726.md): \[20240205\] - Core - Inadequate content filtering within the filter code (CVSS 6.5)
- [CVE-2023-40626](https://cve.now/CVE-2023-40626.md): \[20231101\] - Core - Exposure of environment variables (no CVSS)
- [CVE-2023-23754](https://cve.now/CVE-2023-23754.md): \[20230501\] - Core - Open Redirect and XSS within the mfa select (CVSS 6.1)
- [CVE-2023-23755](https://cve.now/CVE-2023-23755.md): \[20230502\] - Core - Bruteforce prevention within the mfa screen (CVSS 7.5)
- [CVE-2023-23752](https://cve.now/CVE-2023-23752.md): \[20230201\] - Core - Improper access check in webservice endpoints (CVSS 5.3, KEV)
- [CVE-2023-23751](https://cve.now/CVE-2023-23751.md): \[20230102\] - Core - Missing ACL checks for com\_actionlogs (CVSS 4.3)
- [CVE-2023-23750](https://cve.now/CVE-2023-23750.md): \[20230101\] - Core - CSRF within post-installation messages (CVSS 6.3)
- [CVE-2022-27914](https://cve.now/CVE-2022-27914.md): \[20221101\] - Core - RXSS through reflection of user input in com\_media (no CVSS)
- [CVE-2022-27913](https://cve.now/CVE-2022-27913.md): \[20221002\] - Core - RXSS through reflection of user input in headings (no CVSS)
- [CVE-2022-27912](https://cve.now/CVE-2022-27912.md): \[20221001\] - Core - Debug Mode leaks full request payloads including passwords (no CVSS)
- [CVE-2022-27911](https://cve.now/CVE-2022-27911.md): \[20220801\] - Core - Multiple Full Path Disclosures because of missing '\_JEXEC or die check' (no CVSS)
- [CVE-2022-23801](https://cve.now/CVE-2022-23801.md): \[20220309\] - Core - XSS attack vector through SVG (no CVSS)
- [CVE-2022-23800](https://cve.now/CVE-2022-23800.md): \[20220308\] - Core - Inadequate content filtering within the filter code (no CVSS)
- [CVE-2022-23799](https://cve.now/CVE-2022-23799.md): \[20220307\] - Core - Variable Tampering on JInput $\_REQUEST data (no CVSS)
- [CVE-2022-23798](https://cve.now/CVE-2022-23798.md): \[20220306\] - Core - Inadequate validation of internal URLs (no CVSS)
- [CVE-2022-23797](https://cve.now/CVE-2022-23797.md): \[20220305\] - Core - Inadequate filtering on the selected Ids (no CVSS)
- [CVE-2022-23796](https://cve.now/CVE-2022-23796.md): \[20220304\] - Core - Missing input validation within com\_fields class inputs (no CVSS)
- [CVE-2022-23795](https://cve.now/CVE-2022-23795.md): \[20220303\] - Core - User row are not bound to a authentication mechanism (no CVSS)
- [CVE-2022-23794](https://cve.now/CVE-2022-23794.md): \[20220302\] - Core - Path Disclosure within filesystem error messages (no CVSS)
- [CVE-2022-23793](https://cve.now/CVE-2022-23793.md): \[20220301\] - Core - Zip Slip within the Tar extractor (no CVSS)
- [CVE-2021-26040](https://cve.now/CVE-2021-26040.md): \[20210801\] - Core - Insufficient access control for com\_media deletion endpoint (no CVSS)
- [CVE-2021-26039](https://cve.now/CVE-2021-26039.md): \[20210705\] - Core - XSS in com\_media imagelist (no CVSS)
- [CVE-2021-26038](https://cve.now/CVE-2021-26038.md): \[20210704\] - Core - Privilege escalation through com\_installer (no CVSS)
- [CVE-2021-26037](https://cve.now/CVE-2021-26037.md): \[20210703\] - Core - Lack of enforced session termination (no CVSS)
- [CVE-2021-26036](https://cve.now/CVE-2021-26036.md): \[20210702\] - Core - DoS through usergroup table manipulation (no CVSS)
- [CVE-2021-26035](https://cve.now/CVE-2021-26035.md): \[20210701\] - Core - XSS in JForm Rules field (no CVSS)
- [CVE-2021-26034](https://cve.now/CVE-2021-26034.md): \[20210503\] - Core - CSRF in data download endpoints (no CVSS)
- [CVE-2021-26033](https://cve.now/CVE-2021-26033.md): \[20210502\] - Core - CSRF in AJAX reordering endpoint (no CVSS)
- [CVE-2021-26032](https://cve.now/CVE-2021-26032.md): \[20210501\] - Core - Adding HTML to the executable block list of MediaHelper::canUpload (no CVSS)
- [CVE-2021-26031](https://cve.now/CVE-2021-26031.md): \[20210402\] - Core - Inadequate filters on module layout settings (no CVSS)
- [CVE-2021-26030](https://cve.now/CVE-2021-26030.md): \[20210401\] - Core - Escape xss in logo parameter error pages (no CVSS)
- [CVE-2021-26029](https://cve.now/CVE-2021-26029.md): \[20210309\] - Core - Inadequate filtering of form contents could allow to overwrite the author field (no CVSS)
- [CVE-2021-26028](https://cve.now/CVE-2021-26028.md): \[20210308\] - Core - Path Traversal within joomla/archive zip class (no CVSS)
- [CVE-2021-26027](https://cve.now/CVE-2021-26027.md): \[20210307\] - Core - ACL violation within com\_content frontend editing (no CVSS)
- [CVE-2021-23132](https://cve.now/CVE-2021-23132.md): \[20210306\] - Core - com\_media allowed paths that are not intended for image uploads (no CVSS)
- [CVE-2021-23131](https://cve.now/CVE-2021-23131.md): \[20210305\] - Core - Input validation within the template manager (no CVSS)
- [CVE-2021-23130](https://cve.now/CVE-2021-23130.md): \[20210304\] - Core - XSS within the feed parser library (no CVSS)
- [CVE-2021-23129](https://cve.now/CVE-2021-23129.md): \[20210303\] - Core - XSS within alert messages showed to users (no CVSS)
- [CVE-2021-23128](https://cve.now/CVE-2021-23128.md): \[20210302\] - Core - Potential Insecure FOFEncryptRandval (no CVSS)
- [CVE-2021-23127](https://cve.now/CVE-2021-23127.md): \[20210301\] - Core - Insecure randomness within 2FA secret generation (no CVSS)
- [CVE-2021-23126](https://cve.now/CVE-2021-23126.md): \[20210301\] - Core - Insecure randomness within 2FA secret generation (no CVSS)
- [CVE-2021-23125](https://cve.now/CVE-2021-23125.md): \[20210103\] - Core - XSS in com\_tags image parameters (no CVSS)
- [CVE-2021-23124](https://cve.now/CVE-2021-23124.md): \[20210102\] - Core - XSS in mod\_breadcrumbs aria-label attribute (no CVSS)
- [CVE-2021-23123](https://cve.now/CVE-2021-23123.md): \[20210101\] - Core - com\_modules exposes module names (no CVSS)
- [CVE-2020-35616](https://cve.now/CVE-2020-35616.md): \[20201107\] - Core - Write ACL violation in multiple core views (no CVSS)
- [CVE-2020-35615](https://cve.now/CVE-2020-35615.md): \[20201106\] - Core - CSRF in com\_privacy emailexport feature (no CVSS)
- [CVE-2020-35614](https://cve.now/CVE-2020-35614.md): \[20201105\] - Core - User Enumeration in backend login (no CVSS)
- [CVE-2020-35613](https://cve.now/CVE-2020-35613.md): \[20201104\] - Core - SQL injection in com\_users list view (no CVSS)
- [CVE-2020-35612](https://cve.now/CVE-2020-35612.md): \[20201103\] - Core - Path traversal in mod\_random\_image (no CVSS)
- [CVE-2020-35611](https://cve.now/CVE-2020-35611.md): \[20201102\] - Core - Disclosure of secrets in Global Configuration page (no CVSS)
- [CVE-2020-35610](https://cve.now/CVE-2020-35610.md): \[20201101\] - Core - com\_finder ignores access levels on autosuggest (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/joomla-project
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.