CVE Intelligence

Vulnerabilidades de Joomla

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Joomla: 69 registro(s), com severidade, exploração e correções.

Joomla! 68Calendar Planner 1

Somente exploradas (KEV) →

CVE-2026-71574 Média · 6.5 CWE-284 18/08/2026
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.
CVE-2026-48958 Alta · 8.8 CWE-284 07/07/2026
Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints
An improper access check allows unauthorized users to create custom fields via webservices endpoints.
CVE-2026-48957 Alta · 8.8 CWE-284 07/07/2026
Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access com_privacy datasets.
CVE-2026-48956 Média · 5.0 CWE-284 07/07/2026
Joomla! Core - [20260710] - Incorrect Access Control in com_modules
An improper access check allows users to display a list of modules in the frontend.
CVE-2026-48955 Média · 6.5 CWE-284 07/07/2026
Joomla! Core - [20260709] - Incorrect Access Control in com_workflow
An improper access check allows unauthorized users to access workflow stage and transition information.
CVE-2026-48954 Média · 6.1 CWE-79 07/07/2026
Joomla! Core - [20260708] - XSS through language overrides
Improper validation leads to a generic XSS vector in the language override feature.
CVE-2026-48953 Média · 6.1 CWE-79 07/07/2026
Joomla! Core - [20260707] - XSS in the generic image output layout
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
CVE-2026-48952 Média · 6.1 CWE-79 07/07/2026
Joomla! Core - [20260706] - XSS in com_installer
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
CVE-2026-48951 Média · 6.1 CWE-79 07/07/2026
Joomla! Core - [20260705] - XSS in various modalreturn layouts
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
CVE-2026-48950 Média · 6.1 CWE-79 07/07/2026
Joomla! Core - [20260704] - XSS in com_templates
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
CVE-2026-48949 Média · 6.1 CWE-79 07/07/2026
Joomla! Core - [20260703] - XSS in MFA method management
Lack of validation leads to an XSS vulnerability in the MFA management views.
CVE-2026-48948 Alta · 8.8 CWE-284 07/07/2026
Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
CVE-2026-48947 Média · 4.9 CWE-284 07/07/2026
Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints
An improper access check allows privileged users to overwrite media files without editing permissions.
CVE-2017-20267 Alta · 8.2 CWE-89 19/06/2026
Joomla! Component Calendar Planner 1.0.1 SQL Injection
Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the category_id parameter. Attackers can send GET requests to the events view with malicious SQL code in the category_id parameter to extract sensitive database information.
CVE-2026-48905 Média · 6.1 CWE-79 26/05/2026
Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
Lack of input filtering leads to an XSS vector in the HTML filter code.
CVE-2026-48904 Crítica · 9.8 CWE-284 26/05/2026
Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
CVE-2026-48903 Média · 6.1 CWE-79 26/05/2026
Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
CVE-2026-48902 Crítica · 9.8 CWE-319 26/05/2026
Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
CVE-2026-48901 Alta · 7.5 CWE-524 26/05/2026
Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
CVE-2026-48900 Média · 4.3 CWE-284 26/05/2026
Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
CVE-2026-48899 Crítica · 9.8 CWE-284 26/05/2026
Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
An improper access check allows privilege escalation through the com_users batch task.
CVE-2026-48898 Crítica · 9.8 CWE-284 26/05/2026
Joomla! Core - [20260513] - Privilege escalation through com_users batch task
An improper access check allows privilege escalation through the com_users batch task.
CVE-2026-48897 Alta · 7.5 CWE-287 26/05/2026
Joomla! Core - [20260512] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
CVE-2026-48896 Alta · 7.5 CWE-287 26/05/2026
Joomla! Core - [20260511] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
CVE-2026-40384 Alta · 7.5 CWE-22 26/05/2026
Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.