Vulnerabilidades de Joomla! Project
CVEs publicadas que afetam produtos de Joomla! Project: 67 registro(s), com severidade, exploração e correções.
CVE-2026-35223
Crítica · 9.8
CWE-284 26/05/2026
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to com_config webservice endpoints.
CVE-2026-35222
Crítica · 9.8
CWE-89 26/05/2026
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
CVE-2026-35221
Crítica · 9.8
CWE-89 26/05/2026
Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
CVE-2026-35220
Média · 4.3
CWE-352 26/05/2026
Joomla! Core - [20260505] - CSRF in user activation endpoint
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
CVE-2026-30895
Média · 6.1
CWE-79 26/05/2026
Joomla! Core - [20260504] - XSS in readmore links
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
CVE-2026-30894
Média · 6.1
CWE-79 26/05/2026
Joomla! Core - [20260503] - XSS in com_contenthistory
Lack of output escaping leads to a XSS vector in the content history component.
CVE-2026-25901
Média · 6.1
CWE-79 26/05/2026
Joomla! Core - [20260502] - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component.
CVE-2026-25900
Média · 6.1
CWE-79 26/05/2026
Joomla! Core - [20260501] - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules.
CVE-2026-23899
Alta · 8.8
CWE-284 01/04/2026
Joomla! Core - [20260306] - Improper access check in webservice endpoints
An improper access check allows unauthorized access to webservice endpoints.
CVE-2026-23898
Alta · 7.2
CWE-73 01/04/2026
Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
CVE-2026-21632
Média · 5.4
CWE-79 01/04/2026
Joomla! Core - [20260304] - XSS vectors in various article title outputs
Lack of output escaping for article titles leads to XSS vectors in various locations.
CVE-2026-21631
Média · 5.4
CWE-79 01/04/2026
Joomla! Core - [20260303] - XSS vector in com_associations comparison view
Lack of output escaping leads to a XSS vector in the multilingual associations component.
CVE-2026-21630
Alta · 8.8
CWE-89 01/04/2026
Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
CVE-2026-21629
Alta · 7.3
CWE-284 01/04/2026
Joomla! Core - [20260301] - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
CVE-2025-63083
Média · 6.1
CWE-79 06/01/2026
Joomla! Core - [20260102] - XSS vector in the pagebreak plugin
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
CVE-2025-63082
Média · 6.1
CWE-79 06/01/2026
Joomla! Core - [20260101] - Inadequate content filtering for data URLs
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
CVE-2023-23752
Média · 5.3
KEV Urgente · 76 Exploit público CWE-284 16/02/2023
Joomla! Improper Access Control Vulnerability
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.