Joomla vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
161 matching records
- Critical10.0Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.55Patch nowKEVEPSS 0.77%Oct 22, 2026
- Medium5.3Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values ar…Check if you run itEPSS 0.16%Oct 5, 2026
- Medium6.3Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0Check if you run itEPSS 0.27%Oct 5, 2026
- Medium5.3Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0Check if you run itEPSS 0.09%Oct 5, 2026
- Medium6.9Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4Check if you run itEPSS 0.29%Oct 5, 2026
- Medium5.1Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0Check if you run itEPSS 0.10%Oct 5, 2026
- High8.7Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8Check if you run itEPSS 0.37%Oct 5, 2026
- Critical9.3Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16Check if you run itEPSS 0.47%Oct 5, 2026
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 1.04%Oct 2, 2026
- Medium6.9Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0Check if you run itEPSS 0.13%Sep 27, 2026
- Medium5.1Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to…Check if you run itEPSS 0.11%Sep 27, 2026
- Critical10.0Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29Check if you run itEPSS 0.47%Sep 26, 2026
- High8.3Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29Check if you run itEPSS 0.33%Sep 26, 2026
- Critical9.2Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29Check if you run itEPSS 0.42%Sep 26, 2026
- Critical9.4Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29Check if you run itEPSS 1.31%Sep 26, 2026
- Critical9.5Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming…Check if you run itEPSS 0.47%Sep 26, 2026
- High8.3Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-typ…Check if you run itEPSS 0.26%Sep 26, 2026
- Critical9.3JoomlaBoat.comのYoutube GalleryにおけるSQL インジェクションの脆弱性Check if you run itEPSS 0.42%Sep 26, 2026
- Unknown[20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIsCheck if you run itEPSS 0.24%Sep 25, 2026
- Unknown[20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatchCheck if you run itEPSS 0.27%Sep 25, 2026
- Unknown[20260914] - Core - MFA Authentication Bypass through rememberme cookiesCheck if you run itEPSS 0.27%Sep 25, 2026
- Unknown[20260913] - Core - Improper ACL checks for varous webservice edit tasksCheck if you run itEPSS 0.23%Sep 25, 2026
- Unknown[20260912] - Core - XSS in module listCheck if you run itEPSS 0.27%Sep 25, 2026
- Unknown[20260910] - Core - Improper ACL checks for workflow stage changesCheck if you run itEPSS 0.16%Sep 25, 2026
- Unknown[20260909] - Core - SSRF vectors in various core extensionsCheck if you run itEPSS 0.24%Sep 25, 2026