CVE Intelligence

Vulnerabilidades de Joomla

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Joomla: 69 registro(s), com severidade, exploração e correções.

Joomla! 68Calendar Planner 1

Somente exploradas (KEV) →

CVE-2026-40383 Crítica · 9.8 CWE-22 26/05/2026
Joomla! Core - [20260509] - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
CVE-2026-35223 Crítica · 9.8 CWE-284 26/05/2026
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to com_config webservice endpoints.
CVE-2026-35222 Crítica · 9.8 CWE-89 26/05/2026
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
CVE-2026-35221 Crítica · 9.8 CWE-89 26/05/2026
Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
CVE-2026-35220 Média · 4.3 CWE-352 26/05/2026
Joomla! Core - [20260505] - CSRF in user activation endpoint
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
CVE-2026-30895 Média · 6.1 CWE-79 26/05/2026
Joomla! Core - [20260504] - XSS in readmore links
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
CVE-2026-30894 Média · 6.1 CWE-79 26/05/2026
Joomla! Core - [20260503] - XSS in com_contenthistory
Lack of output escaping leads to a XSS vector in the content history component.
CVE-2026-25901 Média · 6.1 CWE-79 26/05/2026
Joomla! Core - [20260502] - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component.
CVE-2026-25900 Média · 6.1 CWE-79 26/05/2026
Joomla! Core - [20260501] - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules.
CVE-2026-23899 Alta · 8.8 CWE-284 01/04/2026
Joomla! Core - [20260306] - Improper access check in webservice endpoints
An improper access check allows unauthorized access to webservice endpoints.
CVE-2026-23898 Alta · 7.2 CWE-73 01/04/2026
Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
CVE-2026-21632 Média · 5.4 CWE-79 01/04/2026
Joomla! Core - [20260304] - XSS vectors in various article title outputs
Lack of output escaping for article titles leads to XSS vectors in various locations.
CVE-2026-21631 Média · 5.4 CWE-79 01/04/2026
Joomla! Core - [20260303] - XSS vector in com_associations comparison view
Lack of output escaping leads to a XSS vector in the multilingual associations component.
CVE-2026-21630 Alta · 8.8 CWE-89 01/04/2026
Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
CVE-2026-21629 Alta · 7.3 CWE-284 01/04/2026
Joomla! Core - [20260301] - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
CVE-2025-63083 Média · 6.1 CWE-79 06/01/2026
Joomla! Core - [20260102] - XSS vector in the pagebreak plugin
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
CVE-2025-63082 Média · 6.1 CWE-79 06/01/2026
Joomla! Core - [20260101] - Inadequate content filtering for data URLs
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
CVE-2023-23752 Média · 5.3 KEV Urgente · 76 Exploit público CWE-284 16/02/2023
Joomla! Improper Access Control Vulnerability
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
CVE-2016-10033 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-88 30/12/2016
PHPMailer Command Injection Vulnerability
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.