CVE-2026-23899

Joomla! Core - [20260306] - Improper access check in webservice endpoints

An improper access check allows unauthorized access to webservice endpoints.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-21629

Joomla! Core - [20260301] - ACL hardening in com_ajax

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-23898

Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-21630

Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2023-23752

[20230201] - Core - Improper access check in webservice endpoints

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

CVSS 3.1 · 5.3 Medium EPSS 99.8% KEV · Listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-23132

[20210306] - Core - com_media allowed paths that are not intended for image uploads

An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

CVSS 3.1 · 7.5 High EPSS 6.7% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-23125

[20210103] - Core - XSS in com_tags image parameters

An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23798

[20220306] - Core - Inadequate validation of internal URLs

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23800

[20220308] - Core - Inadequate content filtering within the filter code

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26035

[20210701] - Core - XSS in JForm Rules field

An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23795

[20220303] - Core - User row are not bound to a authentication mechanism

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26040

[20210801] - Core - Insufficient access control for com_media deletion endpoint

An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26034

[20210503] - Core - CSRF in data download endpoints

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in com_banners and com_sysinfo.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26031

[20210402] - Core - Inadequate filters on module layout settings

An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26037

[20210703] - Core - Lack of enforced session termination

An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-23129

[20210303] - Core - XSS within alert messages showed to users

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2022-23801

[20220309] - Core - XSS attack vector through SVG

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-23127

[20210301] - Core - Insecure randomness within 2FA secret generation

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes.

CVSS 3.1 · 9.1 Critical EPSS 1.4% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26029

[20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field

An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite the author field.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Joomla

Products

Joomla\!

CVE-2021-26032

[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload

An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla\!