Veille CVE

Recherche « Joomla joomla\! »

60 CVE

Critique 10 Élevée 12 Moyenne 36 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Joomla joomla\! » ✕
  1. CVE-2026-92232 6.5 Moyenne

    Joomla! Project Joomla! CMS · Joomla! Project Joomla! Framework Filter package · Joomla joomla\!

    Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector.

  2. CVE-2026-92231 6.7 Moyenne

    Joomla! Project Joomla! CMS · Joomla! Project Joomla! Framework Filter package · Joomla joomla\!

    Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector.

  3. CVE-2026-92227 7.5 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.

  4. CVE-2026-92226 6.0 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.

  5. CVE-2026-92225 6.7 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.

  6. CVE-2026-92224 6.7 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.

  7. CVE-2026-92223 3.8 Faible

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents.

  8. CVE-2026-92222 8.0 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors.

  9. CVE-2026-90918 5.3 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.

  10. CVE-2026-90917 5.3 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories.

  11. CVE-2026-90916 2.7 Faible

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents.

  12. CVE-2026-90915 6.5 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions.

  13. CVE-2026-90914 6.4 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts.

  14. CVE-2026-90913 5.5 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints.

  15. CVE-2026-90907 5.3 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration.

  16. CVE-2026-90906 8.3 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper.

  17. CVE-2026-73372 4.3 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.

  18. CVE-2026-73336 6.4 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs.

  19. CVE-2026-72531 5.4 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components.

  20. CVE-2026-71573 8.3 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

  21. CVE-2026-71572 5.4 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.

  22. CVE-2026-73373 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla! Project Joomla! Framework Filesystem package · Joomla joomla\!

    Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

  23. CVE-2026-73371 4.3 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.

  24. CVE-2026-73337 7.5 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.

  25. CVE-2026-72532 5.4 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.

  26. CVE-2026-71574 6.5 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.

  27. CVE-2026-48958 8.8 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows unauthorized users to create custom fields via webservices endpoints.

  28. CVE-2026-48957 8.8 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows unauthorized users to access com_privacy datasets.

  29. CVE-2026-48956 5.0 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows users to display a list of modules in the frontend.

  30. CVE-2026-48955 6.5 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows unauthorized users to access workflow stage and transition information.

  31. CVE-2026-48954 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Improper validation leads to a generic XSS vector in the language override feature.

  32. CVE-2026-48953 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of escaping leads to an XSS vulnerability in the generic image output layout.

  33. CVE-2026-48952 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

  34. CVE-2026-48951 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

  35. CVE-2026-48950 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

  36. CVE-2026-48949 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of validation leads to an XSS vulnerability in the MFA management views.

  37. CVE-2026-48948 8.8 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

  38. CVE-2026-48947 4.9 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows privileged users to overwrite media files without editing permissions.

  39. CVE-2026-48905 6.1 Moyenne

    Joomla! Project Joomla! Framework Filter package · Joomla joomla\!

    Lack of input filtering leads to an XSS vector in the HTML filter code.

  40. CVE-2026-48904 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

  41. CVE-2026-48903 6.1 Moyenne

    Joomla! Project Joomla! Framework Filter package · Joomla joomla\!

    Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.

  42. CVE-2026-48902 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla joomla\!

    The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.

  43. CVE-2026-48901 7.5 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

  44. CVE-2026-48900 4.3 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.

  45. CVE-2026-48899 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows privilege escalation through the com_users batch task.

  46. CVE-2026-48898 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows privilege escalation through the com_users batch task.

  47. CVE-2026-48897 7.5 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Insufficient state checks lead to a vector that allows to bypass 2FA checks.

  48. CVE-2026-48896 7.5 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Insufficient state checks lead to a vector that allows to bypass 2FA checks.

  49. CVE-2026-40384 7.5 Élevée

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

  50. CVE-2026-40383 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper validation of user-supplied input leads to a local file inclusion vulnerability.

  51. CVE-2026-35223 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla joomla\!

    An improper access check allows unauthorized access to com_config webservice endpoints.

  52. CVE-2026-35222 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

  53. CVE-2026-35221 9.8 Critique

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

  54. CVE-2026-35220 4.3 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

  55. CVE-2026-30895 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of output escaping leads to a XSS vector in the readmore links for com_content.

  56. CVE-2026-30894 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of output escaping leads to a XSS vector in the content history component.

  57. CVE-2026-25901 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of output escaping leads to a XSS vector in the multilingual associations component.

  58. CVE-2026-25900 6.1 Moyenne

    Joomla! Project Joomla! CMS · Joomla joomla\!

    Lack of output escaping leads to a XSS vector in the feed modules.

  59. CVE-2023-23752 5.3 Moyenne Exploitée

    Joomla! Project Joomla! CMS · joomla\! · Joomla joomla\!

    An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

  60. CVE-2016-10033 9.8 Critique Exploitée

    Phpmailer project phpmailer · Wordpress wordpress · Joomla joomla\!

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.