JO
CMS
Joomla
On CISA KEVExploited in the wild
424
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 38High 64Medium 152Low 3
Watch
Add Joomla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-23800 | 6.1 | Mar 30 | An issue was discovered in Joomla! 4.0.0 through 4.1.0 Affected: 4.0.0 through 4.1.0 |
| CVE-2022-23798 | 6.1 | Mar 30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0 Affected: 2.5.0 through 3.10.6; 4.0.0 through 4.1.0 |
| CVE-2022-23796 | 6.1 | Mar 30 | An issue was discovered in Joomla! 3.7.0 through 3.10.6 Affected: 3.7.0 through 3.10.6 |
| CVE-2021-26039 | 6.1 | Jul 7 | An issue was discovered in Joomla! 3.0.0 through 3.9.27 Affected: 3.0.0 through 3.9.27 |
| CVE-2021-26035 | 6.1 | Jul 7 | An issue was discovered in Joomla! 3.0.0 through 3.9.27 Affected: 3.0.0 through 3.9.27 |
| CVE-2021-26032 | 6.1 | May 26 | An issue was discovered in Joomla! 3.0.0 through 3.9.26 Affected: 3.0.0 through 3.9.26 |
| CVE-2021-26030 | 6.1 | Apr 14 | An issue was discovered in Joomla! 3.0.0 through 3.9.25 Affected: 3.0.0 through 3.9.25 |
| CVE-2021-23130 | 6.1 | Mar 4 | An issue was discovered in Joomla! 2.5.0 through 3.9.24 Affected: 2.5.0 before 3.9.25 |
| CVE-2021-23129 | 6.1 | Mar 4 | An issue was discovered in Joomla! 2.5.0 through 3.9.24 Affected: 2.5.0 before 3.9.25 |
| CVE-2021-23125 | 6.1 | Jan 12 | An issue was discovered in Joomla! 3.1.0 through 3.9.23 Affected: 3.1.0 through 3.9.23 |
| CVE-2021-23124 | 6.1 | Jan 12 | An issue was discovered in Joomla! 3.9.0 through 3.9.23 Affected: 3.9.0 through 3.9.23 |
| CVE-2020-24599 | 6.1 | Aug 26 | An issue was discovered in Joomla! before 3.9.21 Affected: 3.9.0 before 3.9.21 |
| CVE-2020-24598 | 6.1 | Aug 26 | An issue was discovered in Joomla! before 3.9.21 Affected: 3.0.0 before 3.9.21 |
| CVE-2020-15696 | 6.1 | Jul 15 | An issue was discovered in Joomla! through 3.9.19 Affected: 3.0.0 through 3.9.19 |
| CVE-2020-13762 | 6.1 | Jun 2 | In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS Affected: 3.9.0 before 3.9.19 |
| CVE-2020-13761 | 6.1 | Jun 2 | In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS Affected: 3.0.1 before 3.9.19; 3.0.0; 3.0.0; 3.0.0; 3.0.0 |
| CVE-2020-10242 | 6.1 | Mar 16 | An issue was discovered in Joomla! before 3.9.16 Affected: 3.0.0 before 3.9.16 |
| CVE-2020-8421 | 6.1 | Jan 28 | An issue was discovered in Joomla! before 3.9.15 Affected: 3.9.0 before 3.9.14 |
| CVE-2019-16725 | 6.1 | Sep 24 | In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates Affected: 3.0.0 before 3.9.12 |
| CVE-2019-12766 | 6.1 | Jun 11 | An issue was discovered in Joomla! before 3.9.7 Affected: 3.6.0 through 3.9.6 |
| CVE-2019-11809 | 6.1 | May 20 | An issue was discovered in Joomla! before 3.9.6 Affected: 1.7.0 before 3.9.6 |
| CVE-2019-9714 | 6.1 | Mar 12 | An issue was discovered in Joomla! before 3.9.4 Affected: 3.0.0 before 3.9.4 |
| CVE-2019-9712 | 6.1 | Mar 12 | An issue was discovered in Joomla! before 3.9.4 Affected: 3.2.0 before 3.9.4 |
| CVE-2019-9711 | 6.1 | Mar 12 | An issue was discovered in Joomla! before 3.9.4 Affected: 3.0.0 before 3.9.4 |
| CVE-2019-7742 | 6.1 | Feb 12 | An issue was discovered in Joomla! before 3.9.3 Affected: 1.0.0 through 3.9.2 |
| CVE-2019-7744 | 6.1 | Feb 12 | An issue was discovered in Joomla! before 3.9.3 Affected: 2.5.0 through 3.9.2 |
| CVE-2019-7741 | 6.1 | Feb 12 | An issue was discovered in Joomla! before 3.9.3 Affected: 2.5.0 through 3.9.2 |
| CVE-2019-7740 | 6.1 | Feb 12 | An issue was discovered in Joomla! before 3.9.3 Affected: 2.5.0 through 3.9.2 |
| CVE-2019-7739 | 6.1 | Feb 12 | An issue was discovered in Joomla! before 3.9.3 Affected: 2.5.0 through 3.9.2 |
| CVE-2019-6261 | 6.1 | Jan 16 | An issue was discovered in Joomla! before 3.9.2 Affected: 2.5.0 before 3.9.2 |
| CVE-2019-6264 | 6.1 | Jan 16 | An issue was discovered in Joomla! before 3.9.2 Affected: 2.5.0 before 3.9.2 |
| CVE-2018-12711 | 6.1 | Jun 26 | An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9 Affected: 1.6.0 through 3.8.8 |
| CVE-2018-6378 | 6.1 | May 22 | In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager Affected: before 3.8.8 |
| CVE-2018-6380 | 6.1 | Jan 30 | In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system Affected: before 3.8.4 |
| CVE-2018-6379 | 6.1 | Jan 30 | In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability Affected: before 3.8.4 |
| CVE-2018-6377 | 6.1 | Jan 30 | In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox Affected: before 3.8.4 |
| CVE-2015-5608 | 6.1 | Sep 20 | Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1 Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.1.0; +27 more |
| CVE-2017-11612 | 6.1 | Jul 26 | In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +34 more |
| CVE-2017-9934 | 6.1 | Jul 17 | Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability Affected: 1.7.3; 1.7.4; 1.7.5; 2.5.0; 2.5.1; 2.5.2; +34 more |
| CVE-2017-7987 | 6.1 | Apr 25 | In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +34 more |
| CVE-2017-7986 | 6.1 | Apr 25 | In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +34 more |
| CVE-2017-7985 | 6.1 | Apr 25 | In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components Affected: 1.5.0 through 3.6.5 |
| CVE-2017-7984 | 6.1 | Apr 25 | In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering leads to XSS in the template manager component Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +34 more |
| CVE-2026-92226 | 6.0 | Sep 29 | Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 Affected: 4.0.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2018-11324 | 5.9 | May 22 | An issue was discovered in Joomla! Core before 3.8.8 Affected: before 3.8.8 |
| CVE-2026-90913 | 5.5 | Sep 29 | Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 Affected: 4.0.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2021-26028 | 5.5 | Mar 4 | An issue was discovered in Joomla! 3.0.0 through 3.9.24 Affected: 3.0.0 before 3.9.25 |
| CVE-2026-72531 | 5.4 | Aug 18 | Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 Affected: 4.0.0-5.4.6; 6.0.0-6.1.2 |
| CVE-2026-71572 | 5.4 | Aug 18 | Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 Affected: 3.0.0-5.4.6; 6.0.0-6.1.2 |
| CVE-2026-72532 | 5.4 | Aug 18 | Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 Affected: 4.0.0-5.4.6; 6.0.0-6.1.2 |