Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical9.8The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.May 26, 2026
- High7.5The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.May 26, 2026
- Medium6.4An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.May 26, 2026
- Medium5.3An improper access check allows privilege escalation through the com_users batch task.May 26, 2026
- High8.2An improper access check allows privilege escalation through the com_users batch task.May 26, 2026
- High8.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.May 26, 2026
- High8.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.May 26, 2026
- Medium5.9An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.May 26, 2026
- High7.5An improper validation of user-supplied input leads to a local file inclusion vulnerability.May 26, 2026
- High8.6An improper access check allows unauthorized access to com_config webservice endpoints.May 26, 2026
- Medium6.9Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.May 26, 2026
- Medium6.9Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.May 26, 2026
- Medium4.6Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the readmore links for com_content.May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the content history component.May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the multilingual associations component.May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the feed modules.May 26, 2026
- High7.1Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through multiple filter parameters.EPSS 0.3%May 25, 2026
- High7.1Joomla Component eXtroForms 2.1.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through the filter_type…EPSS 0.3%May 25, 2026
- Medium5.3Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information by tricking authenticated u…EPSS 0.1%May 23, 2026
- High8.8Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting…EPSS 0.4%May 23, 2026
- High8.8Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thr…EPSS 0.4%May 23, 2026
- Medium5.3Joomla JoomOCShop 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users.EPSS 0.2%May 17, 2026
- High8.8Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profil…EPSS 0.3%May 17, 2026
- Medium6.9Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validation.EPSS 0.1%May 17, 2026