JO
CMS
Joomla
On CISA KEVExploited in the wild
424
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 38High 64Medium 152Low 3
Watch
Add Joomla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21631 | 5.4 | Apr 1 | Joomla! Core - [20260303] - XSS vector in com_associations comparison view Affected: 4.0.0-5.4.3; 6.0.0-6.0.3 |
| CVE-2026-21632 | 5.4 | Apr 1 | Joomla! Core - [20260304] - XSS vectors in various article title outputs Affected: 4.0.0-5.4.3; 6.0.0-6.0.3 |
| CVE-2024-21730 | 5.4 | Jul 9 | The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector Affected: 4.0.0 before 4.4.6; 5.0.0 before 5.1.2 |
| CVE-2011-3595 | 5.4 | Jan 22 | Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters Affected: through 1.7.0 |
| CVE-2019-6262 | 5.4 | Jan 16 | An issue was discovered in Joomla! before 3.9.2 Affected: 2.5.0 before 3.9.2 |
| CVE-2018-15880 | 5.4 | Aug 29 | An issue was discovered in Joomla! before 3.8.12 Affected: before 3.8.12 |
| CVE-2026-90907 | 5.3 | Sep 29 | Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 Affected: 1.5.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2026-90918 | 5.3 | Sep 29 | Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 Affected: 4.0.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2026-90917 | 5.3 | Sep 29 | Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 Affected: 4.0.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2025-54477 | 5.3 | Sep 30 | Joomla! Core - [20250902] User-Enumeration in passkey authentication method Affected: 4.0.0-4.4.13; 5.0.0-5.3.3 |
| CVE-2022-27912 | 5.3 | Oct 25 | [20221001] - Core - Debug Mode leaks full request payloads including passwords Affected: 4.0.0-4.2.3 |
| CVE-2022-27911 | 5.3 | Aug 31 | An issue was discovered in Joomla! 4.2.0 Affected: 4.2.0 |
| CVE-2022-23794 | 5.3 | Mar 30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0 Affected: 3.0.0 through 3.10.6; 4.0.0 through 4.1.0 |
| CVE-2021-26037 | 5.3 | Jul 7 | An issue was discovered in Joomla! 2.5.0 through 3.9.27 Affected: 2.5.0 through 3.9.27 |
| CVE-2021-26031 | 5.3 | Apr 14 | An issue was discovered in Joomla! 3.0.0 through 3.9.25 Affected: 3.0.0 through 3.9.25 |
| CVE-2021-26029 | 5.3 | Mar 4 | An issue was discovered in Joomla! 1.6.0 through 3.9.24 Affected: 1.6.0 before 3.9.25 |
| CVE-2021-26027 | 5.3 | Mar 4 | An issue was discovered in Joomla! 3.0.0 through 3.9.24 Affected: 3.0.0 before 3.9.25 |
| CVE-2021-23126 | 5.3 | Mar 4 | An issue was discovered in Joomla! 3.2.0 through 3.9.24 Affected: 3.2.0 before 3.9.25 |
| CVE-2021-23123 | 5.3 | Jan 12 | An issue was discovered in Joomla! 3.0.0 through 3.9.23 Affected: 3.0.0 through 3.9.23 |
| CVE-2020-35614 | 5.3 | Dec 28 | An issue was discovered in Joomla! 3.9.0 through 3.9.22 Affected: 3.9.0 through 3.9.22 |
| CVE-2020-15699 | 5.3 | Jul 15 | An issue was discovered in Joomla! through 3.9.19 Affected: 2.5.0 through 3.9.19 |
| CVE-2020-15698 | 5.3 | Jul 15 | An issue was discovered in Joomla! through 3.9.19 Affected: 3.0.0 through 3.9.19 |
| CVE-2020-11891 | 5.3 | Apr 21 | An issue was discovered in Joomla! before 3.9.17 Affected: 3.8.8 before 3.9.17 |
| CVE-2020-11890 | 5.3 | Apr 21 | An issue was discovered in Joomla! before 3.9.17 Affected: 2.5.0 before 3.9.17 |
| CVE-2020-11889 | 5.3 | Apr 21 | An issue was discovered in Joomla! before 3.9.17 Affected: 2.5.0 before 3.9.17 |
| CVE-2020-10240 | 5.3 | Mar 16 | An issue was discovered in Joomla! before 3.9.16 Affected: 3.0.0 before 3.9.16 |
| CVE-2011-4912 | 5.3 | Feb 4 | Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass Affected: 1.5.0 through 1.5.13 |
| CVE-2011-4907 | 5.3 | Jan 15 | Joomla! 1.5x through 1.5.12: Missing JEXEC Check Affected: 1.5.0 through 1.5.12 |
| CVE-2019-19845 | 5.3 | Dec 18 | In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure Affected: 3.8.0 before 3.9.14 |
| CVE-2019-18674 | 5.3 | Nov 6 | An issue was discovered in Joomla! before 3.9.13 Affected: 3.6.0 before 3.9.13 |
| CVE-2019-15028 | 5.3 | Aug 14 | In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms Affected: 1.6.2 before 3.9.11 |
| CVE-2017-8057 | 5.3 | Apr 25 | In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting Affected: 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0; +34 more |
| CVE-2017-7988 | 5.3 | Apr 25 | In Joomla! 1.6.0 through 3.6.5 (fixed in 3.7.0), inadequate filtering of form contents allows overwriting the author of an article Affected: 1.5.16; 1.5.17; 1.5.18; 1.5.19; 1.5.20; 1.5.21; +34 more |
| CVE-2017-7983 | 5.3 | Apr 25 | In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent using the JMail API leaked the used PHPMailer version in the mail headers Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +34 more |
| CVE-2005-4650 | 5.3 | Dec 31 | Joomla! 1.03 does not restrict the number of "Search" Mambots, which allows remote attackers to cause a denial of service (resource consumption) via a large number of Search… Affected: 1.0.3 |
| CVE-2026-48956 | 5.0 | Jul 7 | Joomla! Core - [20260710] - Incorrect Access Control in com_modules Affected: 4.0.0-5.4.6; 6.0.0-6.1.1 |
| CVE-2026-48947 | 4.9 | Jul 7 | Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints Affected: 4.1.0-5.4.6; 6.0.0-6.1.1 |
| CVE-2025-54476 | 4.8 | Sep 30 | Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code Affected: 3.0.0-3.10.20; 4.0.0-4.4.13; 5.0.0-5.3.3 |
| CVE-2019-6263 | 4.8 | Jan 16 | An issue was discovered in Joomla! before 3.9.2 Affected: 2.5.0 before 3.9.2 |
| CVE-2018-11326 | 4.8 | May 22 | An issue was discovered in Joomla! Core before 3.8.8 Affected: before 3.8.8 |
| CVE-2018-11328 | 4.7 | May 22 | An issue was discovered in Joomla! Core before 3.8.8 Affected: before 3.8.8 |
| CVE-2026-73372 | 4.3 | Aug 18 | Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 Affected: 5.1.0-5.4.6; 6.0.0-6.1.2 |
| CVE-2026-73371 | 4.3 | Aug 18 | Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 Affected: 4.0.0-5.4.6; 6.0.0-6.1.2 |
| CVE-2026-35220 | 4.3 | May 26 | Joomla! Core - [20260505] - CSRF in user activation endpoint Affected: 6.0.0-6.1.0 |
| CVE-2026-48900 | 4.3 | May 26 | Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler Affected: 4.1.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2024-21723 | 4.3 | Feb 29 | Inadequate parsing of URLs could result into an open redirect Affected: 1.5.0 before 3.10.15; 4.0.0 before 4.4.3; 5.0.0 before 5.0.3 |
| CVE-2023-23751 | 4.3 | Feb 1 | An issue was discovered in Joomla! 4.0.0 through 4.2.4 Affected: 4.0.0 through 4.2.4 |
| CVE-2020-15697 | 4.3 | Jul 15 | An issue was discovered in Joomla! through 3.9.19 Affected: 3.0.0 through 3.9.19 |
| CVE-2018-17859 | 4.3 | Oct 9 | An issue was discovered in Joomla! before 3.8.13 Affected: 2.5.0 before 3.8.13 |
| CVE-2018-17857 | 4.3 | Oct 9 | An issue was discovered in Joomla! before 3.8.13 Affected: 3.1.0 before 3.8.13 |