JO
CMS
Joomla
On CISA KEVExploited in the wild
420
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 38High 63Medium 149Low 3
Watch
Add Joomla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-10033 In wildKEV | 9.8 | Dec 30 | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute… Affected: 1.5.0 through 3.6.5 |
| CVE-2026-73373 | 9.8 | Aug 18 | Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 Affected: 1.0.0-5.4.6; 6.0.0-6.1.2 |
| CVE-2026-35221 | 9.8 | May 26 | Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder Affected: 6.0.0-6.1.0; 5.4.0-5.4.5 |
| CVE-2026-40383 | 9.8 | May 26 | Joomla! Core - [20260509] - LFI in HTMLView layout parameter Affected: 3.2.1-5.4.5; 6.0.0-6.1.0 |
| CVE-2026-35222 | 9.8 | May 26 | Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags Affected: 6.0.0-6.1.0; 4.0.0-5.4.5 |
| CVE-2026-48899 | 9.8 | May 26 | Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins Affected: 4.0.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2026-48902 | 9.8 | May 26 | Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links Affected: 3.9.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2026-35223 | 9.8 | May 26 | Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints Affected: 4.0.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2026-48904 | 9.8 | May 26 | Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints Affected: 4.0.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2026-48898 | 9.8 | May 26 | Joomla! Core - [20260513] - Privilege escalation through com_users batch task Affected: 4.0.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2025-25226 | 9.8 | Apr 8 | Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package Affected: 1.0.0 before 2.2.0; 3.0.0 before 3.4.0 |
| CVE-2022-23799 | 9.8 | Mar 30 | An issue was discovered in Joomla! 4.0.0 through 4.1.0 Affected: 4.0.0 through 4.1.0 |
| CVE-2022-23797 | 9.8 | Mar 30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0 Affected: 3.0.0 through 3.10.6; 4.0.0 through 4.1.0 |
| CVE-2022-23795 | 9.8 | Mar 30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0 Affected: 2.5.0 through 3.10.6; 4.0.0 through 4.1.0 |
| CVE-2010-1435 | 9.8 | Jun 21 | Joomla! Core is prone to a security bypass vulnerability Affected: 1.5.0 through 1.5.15 |
| CVE-2010-1433 | 9.8 | Jun 21 | Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input Affected: 1.5.0 through 1.5.15 |
| CVE-2020-35613 | 9.8 | Dec 28 | An issue was discovered in Joomla! 3.0.0 through 3.9.22 Affected: 3.0.0 through 3.9.22 |
| CVE-2020-10243 | 9.8 | Mar 16 | An issue was discovered in Joomla! before 3.9.16 Affected: 1.7.0 before 3.9.16 |
| CVE-2019-19846 | 9.8 | Dec 18 | In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors Affected: 2.5.0 through 3.9.14 |
| CVE-2019-12765 | 9.8 | Jun 11 | An issue was discovered in Joomla! before 3.9.7 Affected: 3.9.0 through 3.9.6 |
| CVE-2019-11831 | 9.8 | May 9 | The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a… Affected: 3.9.3 through 3.9.5 |
| CVE-2019-10945 | 9.8 | Apr 10 | An issue was discovered in Joomla! before 3.9.5 Affected: 1.5.0 through 3.9.4 |
| CVE-2019-7743 | 9.8 | Feb 12 | An issue was discovered in Joomla! before 3.9.3 Affected: 2.5.0 through 3.9.2 |
| CVE-2018-15882 | 9.8 | Aug 29 | An issue was discovered in Joomla! before 3.8.12 Affected: before 3.8.12 |
| CVE-2018-11325 | 9.8 | May 22 | An issue was discovered in Joomla! Core before 3.8.8 Affected: before 3.8.8 |
| CVE-2018-6376 | 9.8 | Jan 30 | In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message Affected: before 3.8.4 |
| CVE-2017-16634 | 9.8 | Nov 10 | In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method Affected: 3.2.0 through 3.8.1 |
| CVE-2017-14596 | 9.8 | Sep 20 | In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +34 more |
| CVE-2017-8917 | 9.8 | May 17 | SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors Affected: 3.7.0 |
| CVE-2016-9081 | 9.8 | Jan 23 | Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors Affected: 3.4.4; 3.4.5; 3.4.6; 3.4.7; 3.4.8; 3.4.8; +27 more |
| CVE-2016-10045 | 9.8 | Dec 30 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging… Affected: 1.5.0 through 3.6.5 |
| CVE-2016-9836 | 9.8 | Dec 5 | The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP… Affected: through 3.6.4 |
| CVE-2016-8869 | 9.8 | Nov 4 | The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by… Affected: through 3.6.3 |
| CVE-2024-27185 | 9.1 | Aug 20 | The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors Affected: 3.0.0 before 3.10.17; 4.0.0 before 4.4.7; 5.0.0 before 5.1.3 |
| CVE-2021-26040 | 9.1 | Aug 24 | An issue was discovered in Joomla! 4.0.0 Affected: 4.0.0 |
| CVE-2021-23128 | 9.1 | Mar 4 | An issue was discovered in Joomla! 3.2.0 through 3.9.24 Affected: 3.2.0 before 3.9.25 |
| CVE-2021-23127 | 9.1 | Mar 4 | An issue was discovered in Joomla! 3.2.0 through 3.9.24 Affected: 3.2.0 before 3.9.25 |
| CVE-2011-1151 | 9.1 | Feb 5 | Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters Affected: 1.6.0 |
Showing 38