JO
CMS
Joomla
On CISA KEVExploited in the wild
424
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 38High 64Medium 152Low 3
Watch
Add Joomla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-17859 | 4.3 | Oct 9 | An issue was discovered in Joomla! before 3.8.13 Affected: 2.5.0 before 3.8.13 |
| CVE-2018-17857 | 4.3 | Oct 9 | An issue was discovered in Joomla! before 3.8.13 Affected: 3.1.0 before 3.8.13 |
| CVE-2018-11327 | 4.3 | May 22 | An issue was discovered in Joomla! Core before 3.8.8 Affected: before 3.8.8 |
| CVE-2017-16633 | 4.3 | Nov 10 | In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users Affected: 3.7.0 through 3.8.1 |
| CVE-2026-92223 | 3.8 | Sep 29 | Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 Affected: 5.0.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2017-14595 | 3.7 | Sep 20 | In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state Affected: 3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.7.4; 3.7.5 |
| CVE-2026-90916 | 2.7 | Sep 29 | Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 Affected: 4.0.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2015-8565 | – | Dec 16 | Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +10 more |
| CVE-2015-8564 | – | Dec 16 | Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an… Affected: 3.4.0; 3.4.1; 3.4.3; 3.4.4; 3.4.5 |
| CVE-2015-8563 | – | Dec 16 | Cross-site request forgery (CSRF) vulnerability in the com_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to hijack the… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +10 more |
| CVE-2015-8562 | – | Dec 16 | Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.6; +34 more |
| CVE-2015-7899 | – | Oct 29 | The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +9 more |
| CVE-2015-7859 | – | Oct 29 | The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +9 more |
| CVE-2015-7858 | – | Oct 29 | SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +8 more |
| CVE-2015-7857 | – | Oct 29 | SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +9 more |
| CVE-2015-7297 | – | Oct 29 | SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +9 more |
| CVE-2015-6939 | – | Sep 18 | Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0; 3.4.0; +6 more |
| CVE-2015-5397 | – | Jul 14 | Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +16 more |
| CVE-2015-4654 | – | Jun 18 | SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent Affected: All versions, or not specified |
| CVE-2014-7228 | – | Nov 3 | Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2;… Affected: 2.5.4; 2.5.5; 2.5.6; 2.5.7; 2.5.8; 2.5.9; +34 more |
| CVE-2012-2413 | – | Oct 20 | Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod*… Affected: through 1.5.26; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +22 more |
| CVE-2014-7984 | – | Oct 8 | Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to authenticate and bypass intended restrictions via vectors involving GMail authentication Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +28 more |
| CVE-2014-7983 | – | Oct 8 | Cross-site scripting (XSS) vulnerability in com_contact in Joomla! CMS 3.1.2 through 3.2.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via… Affected: 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.6; 3.2.0; +2 more |
| CVE-2014-7982 | – | Oct 8 | Cross-site scripting (XSS) vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +28 more |
| CVE-2014-7981 | – | Oct 8 | SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; +4 more |
| CVE-2014-7229 | – | Oct 8 | Unspecified vulnerability in Joomla! before 2.5.4 before 2.5.26, 3.x before 3.2.6, and 3.3.x before 3.3.5 allows attackers to cause a denial of service via unspecified vectors Affected: 2.5.4; 2.5.5; 2.5.6; 2.5.7; 2.5.8; 2.5.9; +25 more |
| CVE-2014-6632 | – | Oct 8 | Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +26 more |
| CVE-2014-6631 | – | Oct 8 | Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +3 more |
| CVE-2013-5583 | – | Dec 29 | Cross-site scripting (XSS) vulnerability in libraries/idna_convert/example.php in Joomla! 3.1.5 allows remote attackers to inject arbitrary web script or HTML via the lang… Affected: 3.1.5 |
| CVE-2013-5576 | – | Oct 9 | administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +18 more |
| CVE-2013-3267 | – | May 3 | Cross-site scripting (XSS) vulnerability in the highlighter plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +8 more |
| CVE-2013-3242 | – | May 3 | plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie, which allows… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 2.5.0; 2.5.1; +8 more |
| CVE-2013-3059 | – | May 3 | Cross-site scripting (XSS) vulnerability in the Voting plugin in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +8 more |
| CVE-2013-3058 | – | May 3 | Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +8 more |
| CVE-2013-3057 | – | May 3 | Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +8 more |
| CVE-2013-3056 | – | May 3 | Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +8 more |
| CVE-2013-1455 | – | Feb 13 | Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to an "Undefined variable." Affected: 3.0.0; 3.0.1 |
| CVE-2013-1454 | – | Feb 13 | Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to "Coding errors." Affected: 3.0.0; 3.0.1; 3.0.2 |
| CVE-2013-1453 | – | Feb 13 | plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +6 more |
| CVE-2012-1599 | – | Dec 3 | Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end information" via unknown vectors Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +21 more |
| CVE-2012-1598 | – | Dec 3 | Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerability." Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +21 more |
| CVE-2012-5827 | – | Nov 11 | Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving "Inadequate protection." Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +2 more |
| CVE-2012-4532 | – | Oct 31 | Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +1 more |
| CVE-2012-4531 | – | Oct 31 | Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +1 more |
| CVE-2012-5455 | – | Oct 22 | Cross-site scripting (XSS) vulnerability in the language search component in Joomla! before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 3.0.0 |
| CVE-2011-4911 | – | Oct 7 | Joomla! before 1.5.12 does not perform a JEXEC check in unspecified files, which allows remote attackers to obtain the installation path via unspecified vectors Affected: through 1.5.11; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +6 more |
| CVE-2011-4910 | – | Oct 7 | Cross-site scripting (XSS) vulnerability in Joomla! before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO Affected: through 1.5.11; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +6 more |
| CVE-2011-4909 | – | Oct 7 | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML via the HTTP_REFERER header to (1)… Affected: through 1.5.11; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; +6 more |
| CVE-2012-1117 | – | Sep 26 | Cross-site scripting (XSS) vulnerability in Joomla! 2.5.0 and 2.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 2.5.0; 2.5.1 |
| CVE-2012-1116 | – | Sep 26 | SQL injection vulnerability in Joomla! 1.7.x and 2.5.x before 2.5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +2 more |