Product:

Joomla\!

(Joomla)
Repositories https://github.com/joomla/joomla-cms
#Vulnerabilities 274
Date Id Summary Products Score Patch Annotated
2024-08-20 CVE-2024-27185 The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. Joomla\! N/A
2024-08-20 CVE-2024-27184 Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.. Joomla\! N/A
2024-08-20 CVE-2024-27186 The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Joomla\! N/A
2024-08-20 CVE-2024-27187 Improper Access Controls allows backend users to overwrite their username when disallowed. Joomla\! N/A
2024-08-20 CVE-2024-40743 The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. Joomla\! N/A
2025-01-07 CVE-2024-40748 Lack of output escaping in the id attribute of menu lists. Joomla\! N/A
2025-01-07 CVE-2024-40747 Various module chromes didn't properly process inputs, leading to XSS vectors. Joomla\! N/A
2025-01-07 CVE-2024-40749 Improper Access Controls allows access to protected views. Joomla\! N/A
2025-04-08 CVE-2025-25226 Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used. Joomla\! N/A
2025-04-08 CVE-2025-25227 Insufficient state checks lead to a vector that allows to bypass 2FA checks. Joomla\! N/A