Vulnerabilities in Joomla! Project
140 resultsCVE-2026-48958MEDIUMJoomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpointsEPSS 0.5%CVE-2025-22207MEDIUM[20250201] - Core - SQL injection vulnerability in Scheduled Tasks componentEPSS 0.5%CVE-2024-26278MEDIUM[20240705] - Core - XSS in com_fields default field valueEPSS 0.4%CVE-2023-23751MEDIUM[20230102] - Core - Missing ACL checks for com_actionlogsEPSS 0.4%CVE-2024-21729MEDIUM[20240701] - Core - XSS in accessible media selection fieldEPSS 0.4%CVE-2024-21731MEDIUM[20240703] - Core - XSS in StringHelper::truncate methodEPSS 0.4%CVE-2024-27185CRITICAL[20240802] - Core - Cache Poisoning in PaginationEPSS 0.4%CVE-2022-27913—[20221002] - Core - RXSS through reflection of user input in headingsEPSS 0.4%CVE-2024-40748HIGH[20250102] - Core - XSS vector in the id attribute of menu listsEPSS 0.4%CVE-2024-21730MEDIUM[20240702] - Core - Self-XSS in fancyselect list field layoutEPSS 0.4%CVE-2026-48957MEDIUMJoomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpointsEPSS 0.4%CVE-2026-48948MEDIUMJoomla! Core - [20260702] - Incorrect Access Control in com_contact vcf downloadEPSS 0.4%CVE-2025-25227HIGH[20250402] - Joomla Core - MFA Authentication BypassEPSS 0.4%CVE-2026-23899HIGHJoomla! Core - [20260306] - Improper access check in webservice endpointsEPSS 0.4%CVE-2023-23754MEDIUM[20230501] - Core - Open Redirect and XSS within the mfa selectEPSS 0.4%CVE-2020-35615—[20201106] - Core - CSRF in com_privacy emailexport featureEPSS 0.4%CVE-2024-40749HIGH[20250103] - Core - Read ACL violation in multiple core viewsEPSS 0.4%CVE-2026-48896HIGHJoomla! Core - [20260511] - MFA Authentication BypassEPSS 0.4%CVE-2024-27187HIGH[20240804] - Core - Improper ACL for backend profile viewEPSS 0.4%CVE-2026-21630MEDIUMJoomla! Core - [20260302] - SQL injection in com_content articles webservice endpointEPSS 0.3%