Vulnerabilities in Joomla! Project
140 resultsCVE-2022-23800—[20220308] - Core - Inadequate content filtering within the filter codeEPSS 0.7%CVE-2026-73373HIGHJoomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2EPSS 0.6%CVE-2022-27912—[20221001] - Core - Debug Mode leaks full request payloads including passwordsEPSS 0.6%CVE-2022-27911—[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'EPSS 0.6%CVE-2022-23798—[20220306] - Core - Inadequate validation of internal URLsEPSS 0.6%CVE-2022-23801—[20220309] - Core - XSS attack vector through SVGEPSS 0.6%CVE-2022-23796—[20220304] - Core - Missing input validation within com_fields class inputsEPSS 0.6%CVE-2023-23755HIGH[20230502] - Core - Bruteforce prevention within the mfa screenEPSS 0.6%CVE-2022-27914—[20221101] - Core - RXSS through reflection of user input in com_mediaEPSS 0.6%CVE-2024-21723MEDIUM[20240202] - Core - Open redirect in installation applicationEPSS 0.5%CVE-2026-40384MEDIUMJoomla! Core - [20260510] - Path traversal in com_media webservice endpointEPSS 0.5%CVE-2024-21724MEDIUM[20240203] - Core - XSS in media selection fieldsEPSS 0.5%CVE-2024-21722MEDIUM[20240201] - Core - Insufficient session expiration in MFA management viewsEPSS 0.5%CVE-2021-26033—[20210502] - Core - CSRF in AJAX reordering endpointEPSS 0.5%CVE-2021-26034—[20210503] - Core - CSRF in data download endpointsEPSS 0.5%CVE-2025-22213HIGH[20250301] - Core - Malicious file uploads via Media ManagerEPSS 0.5%CVE-2025-25226CRITICAL[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database packageEPSS 0.5%CVE-2026-73337HIGHJoomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2EPSS 0.5%CVE-2024-26279MEDIUM[20240704] - Core - XSS in Wrapper extensionsEPSS 0.5%CVE-2026-23898HIGHJoomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdateEPSS 0.5%