Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical10.0Joomlack Page Builder Improper Access Control VulnerabilityPatch nowKEVEPSS 30.87%Jun 27, 2026
- Critical10.0Widget Factory Joomla Content Editor Improper Access Control VulnerabilityPatch nowKEVEPSS 16.19%Jun 5, 2026
- High8.8Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation.Check if you run itEPSS 0.23%Jun 3, 2026
- High7.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection.Check if you run itEPSS 0.23%Jun 3, 2026
- High8.8Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting malici…Check if you run itEPSS 0.34%Jun 1, 2026
- Medium6.9Lack of input filtering leads to an XSS vector in the HTML filter code.Check if you run itEPSS 0.24%May 26, 2026
- High8.2An improper access check allows privelege escalation through the com_users group editing webservice endpoint.Check if you run itEPSS 0.53%May 26, 2026
- Medium6.9Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.Check if you run itEPSS 0.24%May 26, 2026
- Critical9.8The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.Check if you run itEPSS 0.33%May 26, 2026
- High7.5The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.Check if you run itEPSS 0.42%May 26, 2026
- Medium6.4An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.Check if you run itEPSS 0.26%May 26, 2026
- Medium5.3An improper access check allows privilege escalation through the com_users batch task.Check if you run itEPSS 0.42%May 26, 2026
- High8.2An improper access check allows privilege escalation through the com_users batch task.Check if you run itEPSS 0.48%May 26, 2026
- High8.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.Check if you run itEPSS 0.36%May 26, 2026
- High8.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.Check if you run itEPSS 0.36%May 26, 2026
- Medium5.9An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.Check if you run itEPSS 0.49%May 26, 2026
- High7.5An improper validation of user-supplied input leads to a local file inclusion vulnerability.Check if you run itEPSS 0.56%May 26, 2026
- High8.6An improper access check allows unauthorized access to com_config webservice endpoints.Check if you run itEPSS 0.51%May 26, 2026
- Medium6.9Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.Check if you run itEPSS 0.45%May 26, 2026
- Medium6.9Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.Check if you run itEPSS 0.45%May 26, 2026
- Medium4.6Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.Check if you run itEPSS 0.14%May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the readmore links for com_content.Check if you run itEPSS 0.24%May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the content history component.Check if you run itEPSS 0.24%May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the multilingual associations component.Check if you run itEPSS 0.24%May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the feed modules.Check if you run itEPSS 0.24%May 26, 2026