Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through multiple filter parameters.Check if you run itEPSS 0.28%May 25, 2026
- High7.1Joomla Component eXtroForms 2.1.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through the filter_type…Check if you run itEPSS 0.28%May 25, 2026
- Medium5.3Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information by tricking authenticated u…Check if you run itEPSS 0.13%May 23, 2026
- High8.8Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting…Check if you run itEPSS 0.36%May 23, 2026
- High8.8Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thr…Check if you run itEPSS 0.36%May 23, 2026
- Medium5.3Joomla JoomOCShop 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users.Check if you run itEPSS 0.16%May 17, 2026
- High8.8Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profil…Check if you run itEPSS 0.32%May 17, 2026
- Medium6.9Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validation.Check if you run itEPSS 0.14%May 17, 2026
- High7.1Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code thr…Check if you run itEPSS 0.27%May 13, 2026
- High7.1Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code thr…Check if you run itEPSS 0.27%May 13, 2026
- High8.7Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter.Check if you run itEPSS 0.72%May 13, 2026
- High8.8Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injec…Check if you run itEPSS 0.27%May 13, 2026
- High8.8Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbit…Check if you run itEPSS 0.31%May 10, 2026
- Medium5.1Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET par…Check if you run itEPSS 0.23%Apr 9, 2026
- Medium5.1Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating multip…Check if you run itEPSS 0.23%Apr 9, 2026
- Medium5.1Joomla VirtueMart Shopping-Cart 4.0.12 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the ke…Check if you run itEPSS 0.19%Apr 9, 2026
- Medium5.1Joomla iProperty Real Estate 4.1.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the filter…Check if you run itEPSS 0.22%Apr 9, 2026
- Medium5.1Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the review_id URL parameter.Check if you run itEPSS 0.19%Apr 9, 2026
- Critical9.3nextendweb smart_slider_3 Embedded Malicious CodePatch nowKEVEPSS 0.97%Apr 7, 2026
- High8.6An improper access check allows unauthorized access to webservice endpoints.Check if you run itEPSS 0.40%Apr 1, 2026
- High8.6Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.Check if you run itEPSS 0.45%Apr 1, 2026
- Medium5.9Lack of output escaping for article titles leads to XSS vectors in various locations.Check if you run itEPSS 0.19%Apr 1, 2026
- Medium5.9Lack of output escaping leads to a XSS vector in the multilingual associations component.Check if you run itEPSS 0.22%Apr 1, 2026
- Medium6.9Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.Check if you run itEPSS 0.34%Apr 1, 2026
- Medium6.3The ajax component was excluded from the default logged-in-user check in the administrative area.Check if you run itEPSS 0.25%Apr 1, 2026