Joomla! Project vulnerabilities
140 CVEs and advisories name Joomla! Project as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-40626[20231101] - Core - Exposure of environment variables
- CVE-2023-23754[20230501] - Core - Open Redirect and XSS within the mfa select
- CVE-2023-23755[20230502] - Core - Bruteforce prevention within the mfa screen
- CVE-2023-23752[20230201] - Core - Improper access check in webservice endpoints
- CVE-2023-23751[20230102] - Core - Missing ACL checks for com_actionlogs
- CVE-2023-23750[20230101] - Core - CSRF within post-installation messages
- CVE-2022-27914[20221101] - Core - RXSS through reflection of user input in com_media
- CVE-2022-27913[20221002] - Core - RXSS through reflection of user input in headings
- CVE-2022-27912[20221001] - Core - Debug Mode leaks full request payloads including passwords
- CVE-2022-27911[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'
- CVE-2022-23801[20220309] - Core - XSS attack vector through SVG
- CVE-2022-23800[20220308] - Core - Inadequate content filtering within the filter code
- CVE-2022-23799[20220307] - Core - Variable Tampering on JInput $_REQUEST data
- CVE-2022-23798[20220306] - Core - Inadequate validation of internal URLs
- CVE-2022-23797[20220305] - Core - Inadequate filtering on the selected Ids
- CVE-2022-23796[20220304] - Core - Missing input validation within com_fields class inputs
- CVE-2022-23795[20220303] - Core - User row are not bound to a authentication mechanism
- CVE-2022-23794[20220302] - Core - Path Disclosure within filesystem error messages
- CVE-2022-23793[20220301] - Core - Zip Slip within the Tar extractor
- CVE-2021-26040[20210801] - Core - Insufficient access control for com_media deletion endpoint
- CVE-2021-26039[20210705] - Core - XSS in com_media imagelist
- CVE-2021-26038[20210704] - Core - Privilege escalation through com_installer
- CVE-2021-26037[20210703] - Core - Lack of enforced session termination
- CVE-2021-26036[20210702] - Core - DoS through usergroup table manipulation
- CVE-2021-26035[20210701] - Core - XSS in JForm Rules field
- CVE-2021-26034[20210503] - Core - CSRF in data download endpoints
- CVE-2021-26033[20210502] - Core - CSRF in AJAX reordering endpoint
- CVE-2021-26032[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload
- CVE-2021-26031[20210402] - Core - Inadequate filters on module layout settings
- CVE-2021-26030[20210401] - Core - Escape xss in logo parameter error pages