CVEs published by Joomla! Project

CVEs published by Joomla! Project (CVE Numbering Authority). 81 tracked.

• CVE-2026-65883 CRITICAL 9.8 UPGRADE Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 2
• CVE-2026-56292 HIGH 7.5 UPGRADE Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in
• CVE-2026-60024 CRITICAL 9.8 Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla exten
• CVE-2026-65879 CRITICAL 9.8 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page
• CVE-2026-65884 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows use
• CVE-2026-65887 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassw
• CVE-2026-65888 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method a
• CVE-2026-76606 CRITICAL 10.0 Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
• CVE-2026-65890 CRITICAL 9.8 UPGRADE Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors all
• CVE-2026-60027 HIGH 8.7 Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 -
• CVE-2026-62414 CRITICAL 9.1 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Pag
• CVE-2026-57832 HIGH 8.7 Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extens
• CVE-2026-65886 HIGH 7.5 UPGRADE Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer al
• CVE-2026-60034 CRITICAL 9.4 Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extensio
• CVE-2026-65885 HIGH 8.8 UPGRADE Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods
• CVE-2026-66494 HIGH 8.7 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0
• CVE-2026-63048 CRITICAL 9.4 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3
• CVE-2026-65889 HIGH 7.5 UPGRADE Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp me
• CVE-2026-57833 HIGH 8.6 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analy
• CVE-2026-65943 HIGH 7.5 UPGRADE Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
• CVE-2026-76601 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not
• CVE-2026-67287 MEDIUM 6.3 Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthent
• CVE-2026-65944 HIGH 8.8 UPGRADE Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0
• CVE-2026-66488 MEDIUM 5.3 UPGRADE Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
• CVE-2026-66489 MEDIUM 5.3 UPGRADE Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
• CVE-2026-65891 MEDIUM 6.5 UPGRADE Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename
• CVE-2026-65947 HIGH 7.3 UPGRADE Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
• CVE-2026-60033 MEDIUM 5.1 Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extensio
• CVE-2026-66490 MEDIUM 6.1 UPGRADE Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
• CVE-2026-61901 MEDIUM 6.1 Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnera
• CVE-2026-65946 MEDIUM 6.1 UPGRADE Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0
• CVE-2026-66915 CRITICAL 10.0 Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could
• CVE-2026-67282 CRITICAL 10.0 Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated
• CVE-2026-76604 CRITICAL 10.0 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
• CVE-2026-76605 CRITICAL 10.0 Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.
• CVE-2026-76607 CRITICAL 10.0 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.
• CVE-2026-77995 CRITICAL 10.0 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Singl
• CVE-2026-74253 CRITICAL 10.0 Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer
• CVE-2026-67285 CRITICAL 9.2 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.
• CVE-2026-74254 CRITICAL 9.3 Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder
• CVE-2026-77992 CRITICAL 9.5 Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUp
• CVE-2026-76571 CRITICAL 9.3 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik <
• CVE-2026-76597 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in F
• CVE-2026-76598 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik
• CVE-2026-76602 CRITICAL 9.3 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order para
• CVE-2026-76596 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The lis
• CVE-2026-76599 HIGH 8.7 Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik <
• CVE-2026-67363 HIGH 7.7 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeChar
• CVE-2026-66917 HIGH 8.6 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged c
• CVE-2026-76611 MEDIUM 6.9 Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo <
• CVE-2026-76612 HIGH 8.6 Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User
• CVE-2026-77027 HIGH 8.6 Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied
• CVE-2026-67283 MEDIUM 6.9 Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 -
• CVE-2026-67286 MEDIUM 6.3 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Bui
• CVE-2026-66916 MEDIUM 6.9 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery
• CVE-2026-76600 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteCommen
• CVE-2026-76603 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The i
• CVE-2026-76608 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.
• CVE-2026-76609 MEDIUM 6.9 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdate
• CVE-2026-77993 MEDIUM 5.3 Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder
• CVE-2026-77028 MEDIUM 5.3 Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo
• CVE-2026-71570 MEDIUM 5.1 Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend op
• CVE-2026-67284 MEDIUM 5.3 Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 -
• CVE-2026-77029 MEDIUM 4.6 Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66
• CVE-2026-66914 CRITICAL 9.2 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unaut
• CVE-2026-77994 CRITICAL 9.3 Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension
• CVE-2026-66491 HIGH 8.2 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of path
• CVE-2026-66492 MEDIUM 6.1 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitatio
• CVE-2026-66493 MEDIUM 6.4 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitatio
• CVE-2026-102786 HIGH 8.6 Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Ph
• CVE-2026-73373 CRITICAL 9.8 UPGRADE Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The defau
• CVE-2026-73337 HIGH 7.5 UPGRADE Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient sta
• CVE-2026-71573 HIGH 8.3 UPGRADE Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper i
• CVE-2026-71574 MEDIUM 6.5 UPGRADE Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6
• CVE-2026-73336 MEDIUM 6.4 UPGRADE Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escap
• CVE-2026-72532 MEDIUM 5.4 UPGRADE Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0
• CVE-2026-71572 MEDIUM 5.4 UPGRADE Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - L
• CVE-2026-72531 MEDIUM 5.4 UPGRADE Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7,
• CVE-2026-73371 MEDIUM 4.3 UPGRADE Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An
• CVE-2026-73372 MEDIUM 4.3 UPGRADE Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 a
• CVE-2026-102785 CRITICAL 10.0 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOthem

← Back to latest CVEs