Joomla

Latest CVEs · RSS

• CVE-2026-102783 2026-10-08 · CVSS 6.3
  Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site Upload
• CVE-2026-102784 2026-10-08 · CVSS 8.7
  Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token
• CVE-2026-102782 2026-10-07 · CVSS 9.3
  Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass
• CVE-2026-102781 2026-10-07 · CVSS 6.9
  Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s
• CVE-2026-102779 2026-10-05 · CVSS 6.9
  Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site t
• CVE-2026-102777 2026-10-05 · CVSS 6.3
  Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the
• CVE-2026-102426 2026-10-05 · CVSS 5.3
  Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum va
• CVE-2026-102778 2026-10-05 · CVSS 5.3
  Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image li
• CVE-2026-102780 2026-10-05 · CVSS 6.9
  Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally auth
• CVE-2026-102776 2026-10-05 · CVSS 5.1
  Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of
• CVE-2026-102775 2026-10-05 · CVSS 8.7
  Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file downlo
• CVE-2026-102428 2026-10-05 · CVSS 9.3
  Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properl
• CVE-2026-102427 2026-09-30 · CVSS 10.0
  Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s n
• CVE-2026-76570 2026-09-30 · CVSS 10.0
  Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Jo
• CVE-2026-102424 2026-09-29 · CVSS 8.9
  Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Form
• CVE-2026-102425 2026-09-29 · CVSS 9.5
  Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP
• CVE-2026-101126 2026-09-29 · CVSS 6.9
  Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checkin
• CVE-2026-101112 2026-09-29 · CVSS 6.9
  Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer atta
• CVE-2026-101127 2026-09-29 · CVSS 8.6
  Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded
• CVE-2026-90915 2026-09-29 · CVSS 7.0
  Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache g
• CVE-2026-92226 2026-09-29 · CVSS 7.0
  Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows una
• CVE-2026-92224 2026-09-29 · CVSS 5.9
  Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leadi
• CVE-2026-90907 2026-09-29 · CVSS 6.9
  Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controll
• CVE-2026-90914 2026-09-29 · CVSS 5.9
  Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability i
• CVE-2026-92231 2026-09-29 · CVSS 7.1
  Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute met