Joomla vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
161 matching records
- Unknown[20260911] - Core - XSS in link toolbar layoutCheck if you run itEPSS 0.27%Sep 25, 2026
- Unknown[20260908] - Core - XSS in HTML Mail TemplatesCheck if you run itEPSS 0.20%Sep 25, 2026
- Unknown[20260907] - Core - Improper ACL checks in outputs for tagged itemsCheck if you run itEPSS 0.20%Sep 25, 2026
- Unknown[20260906] - Core - Improper ACL checks in content history comparison viewCheck if you run itEPSS 0.19%Sep 25, 2026
- Unknown[20260905] - Core - Arbitrary directory deletion via cache purge actionCheck if you run itEPSS 0.34%Sep 25, 2026
- Unknown[20260904] - Core - XSS in the generic media output layoutsCheck if you run itEPSS 0.22%Sep 25, 2026
- Unknown[20260903] - Core - Improper ACL checks for access level webservice endpointsCheck if you run itEPSS 0.21%Sep 25, 2026
- Unknown[20260902] - Core - Unauthorized user account creation via profile.save controllerCheck if you run itEPSS 0.25%Sep 25, 2026
- Unknown[20260901] - Core - XSS in HTMLHelper::link methodCheck if you run itEPSS 0.22%Sep 25, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.43%Sep 22, 2026
- High8.6Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Si…Check if you run itEPSS 0.52%Aug 21, 2026
- Medium5.1Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded…Check if you run itEPSS 0.54%Aug 21, 2026
- Medium6.3Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another cu…Check if you run itEPSS 0.41%Aug 21, 2026
- High8.7Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as…Check if you run itEPSS 0.41%Aug 21, 2026
- Medium5.3Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token cou…Check if you run itEPSS 0.19%Aug 21, 2026
- Medium5.3Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66Check if you run itEPSS 0.41%Aug 21, 2026
- High8.6Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject…Check if you run itEPSS 0.37%Aug 21, 2026
- High8.6Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field eleme…Check if you run itEPSS 0.44%Aug 21, 2026
- Medium6.9Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.Check if you run itEPSS 0.50%Aug 21, 2026
- High7.0Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glo…Check if you run itEPSS 0.47%Aug 21, 2026
- Medium4.6Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66Check if you run itEPSS 0.21%Aug 21, 2026
- Unknown[20260810] - Core - Unrestricted uploads of SHTML filesCheck if you run itEPSS 0.65%Aug 17, 2026
- Unknown[20260809] - Core - Improper ACL checks when injection schema.org contact dataCheck if you run itEPSS 0.29%Aug 17, 2026
- Unknown[20260808] - Core - Improper ACL checks for batch copy actionsCheck if you run itEPSS 0.29%Aug 17, 2026
- Unknown[20260807] - Core - MFA Authentication BypassCheck if you run itEPSS 0.46%Aug 17, 2026