Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 82

Export CSV
CVE-2026-21626

Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Joomla Stackideas
Products
Joomla Joomla! Easydiscuss
CVE-2026-21624

Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla

Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Joomla Stackideas
Products
Joomla Joomla! Easydiscuss
CVE-2025-54298

Extension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla

A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla Joomla!
CVE-2025-40636

SQL injection in the mod_vvisit_counter module

SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisitcounter’ cookie at all endpoints where the plugin counts visits.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla Joomla! Mod Vvisit Counter
CVE-2025-54477

Joomla! Core - [20250902] User-Enumeration in passkey authentication method

Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla Joomla!
CVE-2025-54476

Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla Joomla!
CVE-2025-54475

Extension - joomsky.com - SQL injection in JS jobs component version 1.3.2 - 1.4.4 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Joomla Joomsky
Products
Joomla Joomla! Js Jobs
CVE-2025-54474

Extension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla

A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla Joomla!
CVE-2025-54473

Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla Joomla!
CVE-2025-54301

Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla Joomla!
CVE-2025-54300

Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla Joomla!
CVE-2025-54299

Extension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla

A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Joomla Nobossextensions
Products
Joomla! No Boss Testimonials Component
CVE-2025-55758

Extension - jdownloads.com - CSRF vectors in jDownloads component 1.0.0 - 4.0.47 for Joomla

Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jdownloads Joomla
Products
Jdownloads Joomla Joomla!
CVE-2025-55757

Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla

A unauthenticated reflected XSS vulnerability in VirtueMart 1.0.0-4.4.10 for Joomla was discovered.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla Virtuemart
Products
Joomla Joomla! Virtuemart
CVE-2026-21632

Joomla! Core - [20260304] - XSS vectors in various article title outputs

Lack of output escaping for article titles leads to XSS vectors in various locations.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-21631

Joomla! Core - [20260303] - XSS vector in com_associations comparison view

Lack of output escaping leads to a XSS vector in the multilingual associations component.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-23899

Joomla! Core - [20260306] - Improper access check in webservice endpoints

An improper access check allows unauthorized access to webservice endpoints.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-21629

Joomla! Core - [20260301] - ACL hardening in com_ajax

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-23898

Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-21630

Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!