Joomla Cms
Monthly
Arbitrary directory deletion in Joomla CMS affects versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, where a backend user holding administrator-level privileges (CVSS PR:H) can pass a cache group name containing path-traversal sequences that the file-based caching layer fails to sanitize, causing the cache purge action to remove directories outside the intended cache path. The result is high integrity and availability impact with no confidentiality loss, rated 7.0 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N/VC:N/VI:H/VA:H) and assessed at CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H by independent analysis. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite confines realistic risk to insider or compromised-administrator scenarios rather than opportunistic remote attackers.
Improper access control in the Joomla CMS Web Services (API) application allows an authenticated user who can reach the affected webservice edit tasks to modify items they are not authorized to edit, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. Because the flaw is an authorization bypass in Joomla's edit-task ACL enforcement, the primary impact is to integrity (CVSS VI:H), with only limited confidentiality and availability effects. Exploitation requires a privileged, authenticated account (CVSS PR:H) and the webservices/API application to be enabled and reachable; no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) was reported.
Cross-site scripting through an InputFilter sanitizer bypass affects Joomla CMS 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, plus the standalone Joomla Framework Filter package. An authenticated user holding content-submission privileges (CVSS 3.1 PR:H) can smuggle a 'javascript:' URI past checkAttribute() by encoding characters as HTML5 entities, and the browser decodes and executes that payload when a victim later views the affected page (UI:R). Publicly available exploit code exists at proof-of-concept level (CVSS v4.0 E:P) and there is no CISA KEV entry confirming active exploitation; impact is script execution inside the victim's session context (scope changed, low confidentiality and integrity impact), making this a moderate-priority defense-in-depth filter bypass rather than a top-tier emergency.
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-privileged attacker to make the server issue requests to arbitrary URLs via improperly validated URLs in various core extensions. Exploitation requires a backend or administrator account and is not achievable by anonymous users; high attack complexity means a single reliable request is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
MFA bypass in Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows an attacker who can drive the login flow to the point a 'rememberme' cookie is issued to present that cookie and skip the second authentication factor entirely, defeating the site's multi-factor policy without possessing valid second-factor credentials. The weakness is only meaningful on installations that both enforce MFA and use persistent-login (remember-me) functionality; sites without MFA enabled are not exposed to this specific bypass, and fully anonymous exploitation is constrained because the attacker must interact with the first-factor login flow or otherwise obtain the issued cookie. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has published advisory 20260914 with fix guidance.
Stored cross-site scripting (XSS) in Joomla CMS allows an authenticated user with HTML-authoring privileges - such as a content author or editor - to slip HTML data: URIs past the InputFilter::cleanAttribute routine by padding them with whitespace characters, so the payload survives sanitisation and executes in the browser of any victim who later views the stored content. Affected releases are Joomla CMS 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, along with the standalone joomla_framework_filter_package. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code was identified in the supplied intelligence, although the vendor-assigned CVSS 4.0 vector does carry an exploit-maturity rating of Proof-of-Concept (E:P); the issue is not exploitable anonymously and depends on a victim rendering the injected content.
Improper access control in Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 lets an authenticated user with webservice API access perform unauthorized mutation (write/change) operations against access-level endpoints, allowing them to alter how content visibility is governed on the site. Exploitation requires the Joomla Web Services API to be enabled and reachable and a valid account (per the assessed vector PR:H, so anonymous internet users cannot trigger it directly); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Rated medium-to-moderate priority - an authorization flaw rather than a critical emergency - with the practical risk concentrated on multi-user or headless/API-enabled sites that grant API tokens to lower-trust accounts.
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote attackers to circumvent 2FA controls and gain authenticated access using only the first-factor credential. Insufficient state validation in the MFA flow exposes a logic path that skips the second-factor verification step entirely. No public exploit or CISA KEV listing has been identified at the time of analysis, though the vulnerability's network accessibility and lack of required privileges make it a meaningful account-takeover risk for any Joomla site with MFA-enrolled users.
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, impacting both the CMS and the Joomla! Framework Filesystem Package. The default blocklist of dangerous file types omitted SHTML files; on servers where SSI (Server Side Includes) is enabled and SHTML execution is active, a privileged user can upload a crafted SHTML file to achieve arbitrary server-side code execution. No public exploit code has been identified at time of analysis, though a vendor advisory has been published at the Joomla Security Centre.
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with insufficient permissions to perform mutation operations that are explicitly restricted in the backend UI, effectively bypassing the platform's ACL system. Affected deployments span Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, covering both actively maintained long-term and current release branches. No public exploit code or active exploitation has been confirmed at time of analysis, though the Authentication Bypass classification and CWE-284 root cause indicate the ACL gap is structurally straightforward to discover and abuse by any user with a valid session.
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a Super User is socially engineered into extracting a crafted ZIP archive via the administrator interface. The extract.php extraction routine failed to validate ZIP entry filenames for parent-directory sequences (`..`), absolute Unix paths, Windows drive letter paths, or UNC paths - allowing an attacker-supplied archive to write arbitrary PHP files outside the intended extraction root. No confirmed active exploitation (not in CISA KEV); an upstream patch is available via GitHub commit and PR, though a tagged patched release version has not been independently confirmed.
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent MFA checks due to insufficient state validation during the authentication flow. The flaw (CWE-287) was disclosed by the Joomla! project itself and tracked as EUVD-2026-31890; no public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), but the integrity impact is high since attackers reaching this path effectively defeat the second authentication factor.
Local file inclusion in Joomla! CMS versions 3.2.1 through 5.4.5 and 6.0.0 through 6.1.0 allows authenticated high-privilege attackers to read arbitrary server files via improper validation of the layout parameter in htmlview. The flaw is reported by the Joomla project itself (EUVD-2026-31888) and no public exploit identified at time of analysis, with EPSS scoring 0.00% and CISA SSVC marking exploitation status as none despite total technical impact.
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor authentication (MFA) due to insufficient state validation during the login flow. The flaw, tracked as CVE-2026-48897 and reported by the Joomla! project, undermines the integrity protections expected from 2FA and could grant attackers access to accounts whose credentials are already known or guessable. EPSS probability is low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis.
Transport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated with plain HTTP URLs instead of HTTPS when the 'Force SSL' configuration flag is not explicitly enabled. Affected installations span Joomla! 3.9.0 through 5.4.5 and 6.0.0 through 6.1.0, exposing reset tokens to network interception. No public exploit identified at time of analysis, and EPSS scores exploitation probability at 0.02% (5th percentile) despite the 9.8 CVSS rating.
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges to access configuration data they should not be permitted to reach, impacting confidentiality, integrity, and availability of the affected site. The flaw spans Joomla 4.0.0-5.4.5 and 6.0.0-6.1.0 and was disclosed by the Joomla! Project itself with a CVSS 4.0 base of 8.6. No public exploit identified at time of analysis and EPSS is very low at 0.04%.
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abuse an improper access check in the com_users group editing webservice endpoint to elevate privileges. The CVSS 4.0 vector indicates network-reachable exploitation without authentication or user interaction, with high impact to integrity but no confidentiality or availability impact. There is no public exploit identified at time of analysis and EPSS is effectively 0%, but the vendor advisory confirms the access-control flaw.
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users batch task due to an improper access check (CWE-284). The flaw enables unauthorized modification of user accounts and elevation of privileges across affected installations, with no public exploit identified at time of analysis. EPSS scoring is 0.00% and the vulnerability is not listed in CISA KEV, but the CVSSv4 base score of 8.2 reflects high integrity impact.
Information disclosure in Joomla! CMS arises because InputFilter::getInstance() builds its instance cache key without including a security-sensitive parameter, allowing a previously cached filter instance to be returned even when a different security posture was requested. Remote unauthenticated attackers can leverage the resulting filter mismatch to retrieve sensitive data (CVSS 7.5, C:H only). No public exploit identified at time of analysis and EPSS is 0.02% (5th percentile), indicating low predicted exploitation in the near term.
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote attackers to delete files on affected servers due to insufficient input validation. The vulnerability affects all versions of Joomla! CMS through the update component and carries moderate-to-high real-world risk because file deletion can compromise system integrity, availability, and potentially enable privilege escalation or secondary attacks when combined with other weaknesses.
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and access protected API functionality without valid credentials. Joomla! CMS versions prior to the patched release are affected. The vulnerability stems from inadequate validation of user permissions before processing webservice requests, enabling remote unauthenticated attackers to interact with restricted endpoints that should require administrative or elevated privileges.
Cross-site scripting in the Joomla CMS link toolbar layout allows an authenticated, high-privilege backend user (administrator or manager level able to reach the link toolbar) to inject script that executes in a second privileged user's browser when that user loads the affected view - a moderate-impact, non-urgent issue rather than an unauthenticated or drive-by attack path. Joomla Core releases 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 are affected in default configuration, with no special feature flag required. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV entry); the high-privilege prerequisite plus mandatory victim interaction substantially limit realistic exploitation.
Unauthenticated remote requests can create lowest-privilege guest-group user accounts on Joomla CMS versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, because the core profile.save controller never checks whether the requester is logged in, so the account-creation path succeeds even on sites where public user registration has been turned off. No CISA KEV listing and no public exploit code were identified at time of analysis. The vendor rates this 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) with a confidentiality-only low impact, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:N; both agree the attack is remote, unauthenticated and requires no user interaction or special configuration, and that the damage is bounded because only the lowest-privilege account level can be created, never an administrative or full registered-user account.
Cross-site scripting in Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 lets a high-privileged authenticated backend account inject an unescaped script payload that is rendered through the core generic audio and video media output layouts, executing in the browser of a second user who views the affected page. Because the vulnerable layouts do not escape user-influenced output, a rogue or compromised elevated account (for example a Manager or Super User) can plant the payload and wait for a victim to load the rendered media; exploitation therefore requires both PR:H authentication and victim page interaction, not anonymous remote access. There is no public exploit identified at time of analysis, no evidence of confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 vector marks exploit maturity as unproven (E:U) with a base score of 5.9.
Cross-site scripting in the HTML mail template feature of Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows attacker-influenced data to reach template fields that are emitted without escaping, so crafted content can execute script when the resulting HTML email is rendered in a browser-based preview or webmail client. Our assessment treats exploitation as requiring the HTML mail template feature to be in use plus an authenticated, operator-level party able to influence template fields and a victim who renders the message, even though the vendor's CVSS 4.0 vector carries PR:N/UI:N; the deliverability of the payload is further limited because many mail clients strip or sanitize inline script. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Joomla has published advisory 20260908 covering the fix.
Improper access-control enforcement in the Joomla CMS workflow feature allows an authenticated backend user to change the workflow stage of content that their assigned ACL should prevent them from touching, in Joomla 5.0.0-5.4.8 and 6.0.0-6.1.3. The CVSS 4.0 vector (5.1, AV:N/AC:L/PR:H) requires a valid backend account, and the impact is limited to the integrity of the workflow stage value (VC:L/VI:L, no availability effect), so this is a genuine but low-priority authorization flaw rather than an emergency. Confirmed actively exploited? No - no CISA KEV listing, and no public exploit code identified at time of analysis; the effect is only meaningful on sites that actually use Joomla's content workflow functionality.
Improper access-control checks in Joomla's tagged-item output let unauthenticated visitors read content items that belong to access-restricted categories, exposing only article content (confidentiality-only) with no modification or denial-of-service impact. Affected releases are Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3; exploitation requires no authentication and no user interaction (PR:N/UI:N in both the supplied CVSS 4.0 vector and our assessed CVSS 3.1 vector), so any anonymous visitor can trigger it on a default site that renders tagged items where tags span categories with differing view levels. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited; the practical risk is bounded because disclosure is limited to tagged items in restricted categories, which is why our independent assessment treats this as a genuine but low-to-moderate priority issue.
Stored cross-site scripting in the Joomla CMS module list layout allows an authenticated administrator-level backend user to supply values that are rendered without escaping, so script executes in the browser of another privileged user who views the module list. Affected releases are Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, and the vendor-assigned CVSS 4.0 base score is 5.9. Because exploitation requires a pre-existing high-privilege account (PR:H) and a victim who opens the affected administrative view (UI:P), the issue is confined to the backend and cannot be triggered by anonymous front-end visitors; no public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and a vendor advisory covering the fixed releases is available from the Joomla Security Centre.
Improper access control in the Joomla CMS content history comparison view allows an authenticated backend user to read content revisions they are not authorized to view, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The issue is rated CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; consistent with the independent CVSS:3.1 vector of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so it is a genuine but low-severity confidentiality-only exposure: PR:H indicates the attacker must already hold a high-privileged, authenticated backend/administrator session, no victim interaction is required, and there is no integrity or availability impact. The leaked data is limited to stored content versions rather than credentials or system data, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Cross-site scripting in Joomla CMS core (HTMLHelper::link) allows an authenticated, high-privileged backend user to inject unescaped markup into links that later executes in a victim's browser when the affected page is rendered. All Joomla releases from 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3 are affected, so any site still running a legacy 1.5/2.5/3.x branch as well as current 5.x and 6.x installations needs attention. Exploitation requires a high-privilege Joomla account (CVSS PR:H) plus a victim who views the crafted link (UI:P/UI:R); no public exploit code exists and there is no indication of active exploitation (not listed in CISA KEV), and the E:U metric keeps the practical risk moderate despite the network attack vector.
Improper CORS origin validation in Joomla! CMS versions 4.0.0-5.4.7 and 6.0.0-6.1.2 allows remote attackers to bypass the configured origin allowlist and make unauthorized cross-origin requests. The CWE-93 (CRLF Injection) classification indicates the bypass mechanism likely involves injecting carriage-return/line-feed characters into the Origin header to confuse the server's string-comparison logic, rather than a simple misconfiguration of the allowlist itself. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, zero-privilege, low-complexity nature of the flaw makes it exploitable at scale against Joomla sites where CORS is configured.
Improper access control (CWE-284) in the custom fields webservice API of Joomla! CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 allows authenticated high-privilege users to create custom fields for components whose ACL restrictions should deny them access. The flaw represents an authorization bypass at the API layer - the REST webservice endpoints for custom fields do not enforce the same component-level ACL checks applied in the web UI, creating a privilege boundary discrepancy. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 with PR:H reflects that exploitation is constrained to already-authenticated, elevated users.
Cross-site scripting in Joomla! CMS versions 5.1.0-5.4.7 and 6.0.0-6.1.2 exposes sites to stored XSS through improperly escaped schema.org structured-data markup output. An attacker holding high-privilege CMS credentials can inject malicious script into schema.org content fields, which subsequently executes in the browsers of users who load affected pages. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; a vendor security advisory has been issued through the Joomla Security Centre.
Improper access control in Joomla! CMS 5.1.0-5.4.7 and 6.0.0-6.1.2 leaks restricted contact data into schema.org structured data snippets embedded in page output. The CMS fails to enforce ACL rules during schema.org contact snippet generation, allowing contact details for items that should be inaccessible to be injected into structured metadata visible in page source. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.
Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed.
Improper ACL enforcement in Joomla! CMS batch copy functionality allows authenticated backend users to copy content items they do not have edit permissions for, effectively bypassing content-level access controls. Affected versions span two active release branches: 4.0.0-5.4.7 and 6.0.0-6.1.2, covering a broad portion of active Joomla deployments. No public exploit code exists at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in active exploitation campaigns.
Joomla! CMS exposes a broken access control flaw on its webservices API category endpoints, permitting users who lack the requisite ACL permissions to create content categories they are explicitly not authorized to manage. The issue spans a large installed base across two major release lines: versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are confirmed affected. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, but the flaw is network-accessible, requires no complex conditions to trigger via the webservices interface, and was reported directly by the Joomla project.
Cross-site scripting in Joomla! CMS's com_installer component exposes the administrator backend to script injection via the update list view, stemming from missing output escaping (CWE-79). The CVSS 4.0 vector (PR:H/UI:P/E:U) confirms exploitation is constrained to sessions where a high-privilege administrator views the maliciously influenced update list, substantially limiting the attack surface. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Joomla! CMS's com_media webservice endpoints allows privileged users to overwrite media files even when they lack explicit editing permissions. The flaw affects two active release lines - 4.1.0 through 5.4.6 and 6.0.0 through 6.1.1 - and is confirmed by the Joomla Security Centre. The CVSS 4.0 vector (SC:H/SI:H/SA:H) indicates that while the direct impact on the vulnerable system is limited (VI:L), successful exploitation can cascade into high-impact consequences on the broader site or dependent systems. No public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect access control in Joomla! CMS exposes com_fields REST API webservices endpoints to users who lack the required permissions, allowing them to create custom field definitions that should be restricted to higher-privileged roles such as Manager or Administrator. The flaw originates from a missing or incorrectly evaluated ACL check in the webservices layer and is confirmed by Joomla's own Security Centre in advisory 20260712. No public exploit has been identified at time of analysis, though the CVSS scope-change metrics indicate potential for significant downstream impact to site content and dependent integrations if unauthorized field definitions are used to inject malicious markup.
Cross-site scripting in Joomla! CMS com_templates file management view allows a high-privileged attacker to inject unescaped malicious script that executes in the browser of any administrator who subsequently views the affected template file listing. Affected versions span Joomla! 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1. No public exploit identified at time of analysis and the CVSS 4.0 supplemental metric E:U confirms no known active exploitation, but the wide install base and admin-targeting nature of the payload make this relevant to Joomla site operators.
Unauthorized access to workflow stage and transition data in Joomla! CMS is possible due to an improper access check in the com_workflow component (CWE-284), allowing authenticated users who lack the necessary workflow management permissions to read internal content publication configuration. The CVSS 4.0 vector assigns high subsequent-system impacts (SC:H/SI:H/SA:H), suggesting the vendor assessed this metadata exposure as a meaningful enabler of broader content pipeline compromise. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Incorrect access control in Joomla! CMS's com_modules component exposes the module listing interface to frontend users who should not have visibility into installed modules. The flaw stems from CWE-284 (Improper Access Control), where the frontend fails to enforce sufficient privilege checks before returning module enumeration data. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided in source data, but the CVSS 4.0 score of 6.4 reflects meaningful subsequent-system impact potential stemming from reconnaissance value of the disclosed module inventory.
Improper access control in Joomla! CMS exposes com_privacy component webservice endpoints to users lacking the required authorization, allowing unauthorized reads of GDPR/privacy datasets. The flaw is classified as CWE-284 and impacts downstream systems at high severity per the vendor-supplied CVSS 4.0 vector, despite requiring high privileges on the vulnerable system itself - a tension that suggests role-boundary bypass rather than fully unauthenticated access. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in Joomla! CMS modalreturn layout components enables a high-privileged attacker to inject and execute arbitrary JavaScript in a victim administrator's browser session. The root cause is insufficient output escaping in multiple component layouts that handle modal return values. No public exploit code has been identified and CISA KEV does not list this vulnerability; the CVSS 4.0 exploitation likelihood metric (E:U) further indicates no observed active exploitation at time of analysis.
Cross-site scripting in Joomla! CMS's generic image output layout enables a high-privileged attacker to inject malicious script payloads that execute in the browsers of other authenticated users who view the affected content. The root cause is absent HTML output escaping in the image rendering component (CWE-79), allowing injected JavaScript to break out of the intended data context. No public exploit has been identified at time of analysis, and exploitation requires a pre-existing high-privileged Joomla account plus passive victim interaction, substantially limiting real-world exposure despite high impact scores on confidentiality and integrity.
Improper access control in Joomla! CMS com_contact component exposes restricted contact records via vcard (VCF) export to authenticated users who should not have access. Affecting versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.1, the flaw allows an authenticated user to bypass access restrictions and download vcard exports of contacts that have been explicitly restricted from their view. No public exploit code or active exploitation has been identified at time of analysis, but the wide deployment footprint of Joomla and the breadth of affected versions (spanning both the 3.x/5.x and 6.x branches) make patching a priority for sites using the com_contact component.
Cross-site scripting in Joomla! CMS multi-factor authentication management views allows a high-privileged attacker to inject persistent malicious scripts that execute in the browser of any administrator who subsequently views the MFA management interface. Affected versions span two major release lines: 4.2.0-5.4.6 and 6.0.0-6.1.1, representing a broad surface across both legacy and current deployments. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, successful exploitation yields high confidentiality and integrity impact against the victim administrator's browser session.
Stored XSS in Joomla CMS's language override administrative feature allows a high-privileged attacker to inject malicious scripts that execute in the browser of any user who subsequently renders the affected language string. Rooted in CWE-79 (improper output neutralization), the vulnerability requires an administrative account to place the payload but can then target other admins or front-end users. No public exploit code has been identified at time of analysis (CVSS E:U), and the vulnerability is not listed in the CISA KEV catalog.
Blind SQL injection in the com_finder (Smart Search) component of Joomla! CMS allows authenticated high-privilege users to extract confidential data from the underlying database across versions 5.4.0-5.4.5 and 6.0.0-6.1.0. The vulnerability stems from improperly constructed SQL filter clauses in search queries that permit attacker-controlled input to alter query logic. No public exploit has been identified at time of analysis, CISA has not added this to the KEV catalog, and EPSS probability sits at 0.03%, signaling minimal observed exploitation pressure.
CSRF token validation is absent on the admin user activation endpoint (com_users component) in Joomla! CMS 6.0.0 through 6.1.0, allowing a remote attacker to trigger unauthorized user activation actions by luring an authenticated administrator into visiting a crafted page. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation requires an active, logged-in administrator and deliberate user interaction, constraining real-world risk despite the network-accessible attack vector. No public exploit code exists and CISA has not added this to KEV; EPSS places exploitation probability at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status.
Authenticated blind SQL injection in Joomla! CMS's com_tags component allows high-privileged attackers to exfiltrate database contents by supplying maliciously crafted ORDER BY clauses that are not properly validated. Affected versions span two distinct release trains: the 4.x/5.x line (4.0.0 through 5.4.5) and the 6.x line (6.0.0 through 6.1.0), meaning the vulnerability persists across both legacy and current major releases. No public exploit code has been identified at time of analysis, and the EPSS score of 0.00% indicates negligible automated exploitation probability, though the high-privilege requirement significantly limits the realistic attacker pool.
Path traversal in Joomla! CMS com_media web service endpoint allows authenticated high-privilege attackers to read arbitrary files outside the intended web root via a manipulated search parameter. Affected versions span two major release trains: 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. No public exploit code exists and no active exploitation has been confirmed, but the vulnerability results in full confidentiality loss of the vulnerable system's filesystem contents accessible to the web process.
Cross-site scripting in Joomla! CMS's multilingual associations component (com_associations) allows an authenticated high-privilege attacker to inject malicious scripts that execute in another user's browser session, yielding high confidentiality impact on the vulnerable system. Affected installations span Joomla! CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. SSVC assessment lists exploitation as none, EPSS is 0.04% (13th percentile), and no public exploit code or CISA KEV listing exists, indicating this is a low-urgency but genuine privilege-escalation-adjacent risk in multi-administrator Joomla environments.
Privilege escalation in Joomla! CMS via the com_users batch task allows low-privileged authenticated users to bypass access controls and elevate their user group membership or permissions. Affected versions span two major release lines: 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0, as confirmed by ENISA EUVD-2026-31880 and the Joomla Security Centre. No public exploit has been identified and EPSS is effectively zero; however, SSVC assesses the technical impact as total, meaning successful exploitation could yield full privilege takeover within the application.
Improper access control in Joomla! CMS com_scheduler component permits low-privileged authenticated backend users to modify the task types of existing scheduler tasks, an operation that should be restricted to higher-privileged administrators. Affected versions span Joomla! 4.1.0 through 5.4.5 and 6.0.0 through 6.1.0. While no public exploit code exists and CISA KEV has not confirmed active exploitation, the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector indicate that tampering with scheduler task types can produce significant integrity and availability consequences beyond the immediately vulnerable component.
Stored cross-site scripting in Joomla! CMS feed modules allows a high-privileged authenticated attacker to inject unsanitized content that executes in the browser context of a victim user who passively views the affected feed output. Affecting the broad version spans of 3.0.0 through 5.4.5 and 6.0.0 through 6.1.0, the root cause is a failure to apply output escaping before rendering feed module data. No public exploit has been identified at time of analysis, and SSVC confirms no current active exploitation.
Reflected or stored cross-site scripting in Joomla! CMS com_content component allows a high-privileged attacker to inject unescaped output into readmore links, executing arbitrary JavaScript in a victim's browser upon interaction. Affected releases span Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0. No public exploit code has been identified and CISA KEV does not list this vulnerability, but a vendor security advisory has been published at the Joomla Security Centre.
Cross-site scripting in Joomla! CMS content history component (com_contenthistory) allows a high-privileged attacker to inject persistent malicious scripts due to missing output escaping, leading to confidentiality compromise of the vulnerable system when a victim views affected history entries. Confirmed affected versions span Joomla! CMS 3.0.0-5.4.5 and 6.0.0-6.1.0 across an exceptionally wide installed base. No public exploit code exists and the vulnerability is not in the CISA KEV catalog; EPSS of 0.04% (13th percentile) confirms no observed widespread exploitation at time of analysis.
SQL injection in Joomla CMS articles webservice endpoint allows remote attackers to execute arbitrary SQL queries through improperly constructed ORDER BY clauses, affecting all versions of Joomla CMS. The vulnerability exists in the com_content component's webservice endpoint and permits unauthenticated query manipulation. No CVSS score or patch version information is available at time of analysis, limiting severity quantification.
Joomla CMS fails to enforce authenticated user checks on the AJAX component in the administrative area, allowing potential authentication bypass and unauthorized access to sensitive functionality. Third-party developers expecting default access controls may expose administrative features to unauthenticated or unauthorized users. No CVSS score or public exploit code has been identified, but the vulnerability affects all Joomla CMS versions and requires immediate review of custom AJAX implementations that rely on implicit authentication enforcement.
Cross-site scripting (XSS) in Joomla CMS multilingual associations component allows unauthenticated remote attackers to inject malicious scripts via unescaped output in the comparison view. The vulnerability affects all versions of Joomla CMS and stems from improper output encoding in the com_associations component. No CVSS score is available; however, the CWE-79 classification confirms reflected or stored XSS capability.
Joomla CMS fails to properly escape article titles in output, enabling stored cross-site scripting (XSS) attacks across multiple locations. Attackers with article creation or editing privileges can inject malicious scripts into article titles that execute in the browsers of site visitors, potentially compromising user sessions, stealing credentials, or defacing content. The vulnerability affects all Joomla CMS versions and requires administrative action to remediate.
Arbitrary directory deletion in Joomla CMS affects versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, where a backend user holding administrator-level privileges (CVSS PR:H) can pass a cache group name containing path-traversal sequences that the file-based caching layer fails to sanitize, causing the cache purge action to remove directories outside the intended cache path. The result is high integrity and availability impact with no confidentiality loss, rated 7.0 under CVSS 4.0 (AV:N/AC:L/PR:H/UI:N/VC:N/VI:H/VA:H) and assessed at CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H by independent analysis. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the high-privilege prerequisite confines realistic risk to insider or compromised-administrator scenarios rather than opportunistic remote attackers.
Improper access control in the Joomla CMS Web Services (API) application allows an authenticated user who can reach the affected webservice edit tasks to modify items they are not authorized to edit, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. Because the flaw is an authorization bypass in Joomla's edit-task ACL enforcement, the primary impact is to integrity (CVSS VI:H), with only limited confidentiality and availability effects. Exploitation requires a privileged, authenticated account (CVSS PR:H) and the webservices/API application to be enabled and reachable; no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) was reported.
Cross-site scripting through an InputFilter sanitizer bypass affects Joomla CMS 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, plus the standalone Joomla Framework Filter package. An authenticated user holding content-submission privileges (CVSS 3.1 PR:H) can smuggle a 'javascript:' URI past checkAttribute() by encoding characters as HTML5 entities, and the browser decodes and executes that payload when a victim later views the affected page (UI:R). Publicly available exploit code exists at proof-of-concept level (CVSS v4.0 E:P) and there is no CISA KEV entry confirming active exploitation; impact is script execution inside the victim's session context (scope changed, low confidentiality and integrity impact), making this a moderate-priority defense-in-depth filter bypass rather than a top-tier emergency.
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-privileged attacker to make the server issue requests to arbitrary URLs via improperly validated URLs in various core extensions. Exploitation requires a backend or administrator account and is not achievable by anonymous users; high attack complexity means a single reliable request is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
MFA bypass in Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows an attacker who can drive the login flow to the point a 'rememberme' cookie is issued to present that cookie and skip the second authentication factor entirely, defeating the site's multi-factor policy without possessing valid second-factor credentials. The weakness is only meaningful on installations that both enforce MFA and use persistent-login (remember-me) functionality; sites without MFA enabled are not exposed to this specific bypass, and fully anonymous exploitation is constrained because the attacker must interact with the first-factor login flow or otherwise obtain the issued cookie. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has published advisory 20260914 with fix guidance.
Stored cross-site scripting (XSS) in Joomla CMS allows an authenticated user with HTML-authoring privileges - such as a content author or editor - to slip HTML data: URIs past the InputFilter::cleanAttribute routine by padding them with whitespace characters, so the payload survives sanitisation and executes in the browser of any victim who later views the stored content. Affected releases are Joomla CMS 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, along with the standalone joomla_framework_filter_package. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code was identified in the supplied intelligence, although the vendor-assigned CVSS 4.0 vector does carry an exploit-maturity rating of Proof-of-Concept (E:P); the issue is not exploitable anonymously and depends on a victim rendering the injected content.
Improper access control in Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 lets an authenticated user with webservice API access perform unauthorized mutation (write/change) operations against access-level endpoints, allowing them to alter how content visibility is governed on the site. Exploitation requires the Joomla Web Services API to be enabled and reachable and a valid account (per the assessed vector PR:H, so anonymous internet users cannot trigger it directly); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Rated medium-to-moderate priority - an authorization flaw rather than a critical emergency - with the practical risk concentrated on multi-user or headless/API-enabled sites that grant API tokens to lower-trust accounts.
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote attackers to circumvent 2FA controls and gain authenticated access using only the first-factor credential. Insufficient state validation in the MFA flow exposes a logic path that skips the second-factor verification step entirely. No public exploit or CISA KEV listing has been identified at the time of analysis, though the vulnerability's network accessibility and lack of required privileges make it a meaningful account-takeover risk for any Joomla site with MFA-enrolled users.
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, impacting both the CMS and the Joomla! Framework Filesystem Package. The default blocklist of dangerous file types omitted SHTML files; on servers where SSI (Server Side Includes) is enabled and SHTML execution is active, a privileged user can upload a crafted SHTML file to achieve arbitrary server-side code execution. No public exploit code has been identified at time of analysis, though a vendor advisory has been published at the Joomla Security Centre.
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with insufficient permissions to perform mutation operations that are explicitly restricted in the backend UI, effectively bypassing the platform's ACL system. Affected deployments span Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, covering both actively maintained long-term and current release branches. No public exploit code or active exploitation has been confirmed at time of analysis, though the Authentication Bypass classification and CWE-284 root cause indicate the ACL gap is structurally straightforward to discover and abuse by any user with a valid session.
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a Super User is socially engineered into extracting a crafted ZIP archive via the administrator interface. The extract.php extraction routine failed to validate ZIP entry filenames for parent-directory sequences (`..`), absolute Unix paths, Windows drive letter paths, or UNC paths - allowing an attacker-supplied archive to write arbitrary PHP files outside the intended extraction root. No confirmed active exploitation (not in CISA KEV); an upstream patch is available via GitHub commit and PR, though a tagged patched release version has not been independently confirmed.
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent MFA checks due to insufficient state validation during the authentication flow. The flaw (CWE-287) was disclosed by the Joomla! project itself and tracked as EUVD-2026-31890; no public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), but the integrity impact is high since attackers reaching this path effectively defeat the second authentication factor.
Local file inclusion in Joomla! CMS versions 3.2.1 through 5.4.5 and 6.0.0 through 6.1.0 allows authenticated high-privilege attackers to read arbitrary server files via improper validation of the layout parameter in htmlview. The flaw is reported by the Joomla project itself (EUVD-2026-31888) and no public exploit identified at time of analysis, with EPSS scoring 0.00% and CISA SSVC marking exploitation status as none despite total technical impact.
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor authentication (MFA) due to insufficient state validation during the login flow. The flaw, tracked as CVE-2026-48897 and reported by the Joomla! project, undermines the integrity protections expected from 2FA and could grant attackers access to accounts whose credentials are already known or guessable. EPSS probability is low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis.
Transport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated with plain HTTP URLs instead of HTTPS when the 'Force SSL' configuration flag is not explicitly enabled. Affected installations span Joomla! 3.9.0 through 5.4.5 and 6.0.0 through 6.1.0, exposing reset tokens to network interception. No public exploit identified at time of analysis, and EPSS scores exploitation probability at 0.02% (5th percentile) despite the 9.8 CVSS rating.
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges to access configuration data they should not be permitted to reach, impacting confidentiality, integrity, and availability of the affected site. The flaw spans Joomla 4.0.0-5.4.5 and 6.0.0-6.1.0 and was disclosed by the Joomla! Project itself with a CVSS 4.0 base of 8.6. No public exploit identified at time of analysis and EPSS is very low at 0.04%.
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abuse an improper access check in the com_users group editing webservice endpoint to elevate privileges. The CVSS 4.0 vector indicates network-reachable exploitation without authentication or user interaction, with high impact to integrity but no confidentiality or availability impact. There is no public exploit identified at time of analysis and EPSS is effectively 0%, but the vendor advisory confirms the access-control flaw.
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users batch task due to an improper access check (CWE-284). The flaw enables unauthorized modification of user accounts and elevation of privileges across affected installations, with no public exploit identified at time of analysis. EPSS scoring is 0.00% and the vulnerability is not listed in CISA KEV, but the CVSSv4 base score of 8.2 reflects high integrity impact.
Information disclosure in Joomla! CMS arises because InputFilter::getInstance() builds its instance cache key without including a security-sensitive parameter, allowing a previously cached filter instance to be returned even when a different security posture was requested. Remote unauthenticated attackers can leverage the resulting filter mismatch to retrieve sensitive data (CVSS 7.5, C:H only). No public exploit identified at time of analysis and EPSS is 0.02% (5th percentile), indicating low predicted exploitation in the near term.
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote attackers to delete files on affected servers due to insufficient input validation. The vulnerability affects all versions of Joomla! CMS through the update component and carries moderate-to-high real-world risk because file deletion can compromise system integrity, availability, and potentially enable privilege escalation or secondary attacks when combined with other weaknesses.
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and access protected API functionality without valid credentials. Joomla! CMS versions prior to the patched release are affected. The vulnerability stems from inadequate validation of user permissions before processing webservice requests, enabling remote unauthenticated attackers to interact with restricted endpoints that should require administrative or elevated privileges.
Cross-site scripting in the Joomla CMS link toolbar layout allows an authenticated, high-privilege backend user (administrator or manager level able to reach the link toolbar) to inject script that executes in a second privileged user's browser when that user loads the affected view - a moderate-impact, non-urgent issue rather than an unauthenticated or drive-by attack path. Joomla Core releases 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 are affected in default configuration, with no special feature flag required. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV entry); the high-privilege prerequisite plus mandatory victim interaction substantially limit realistic exploitation.
Unauthenticated remote requests can create lowest-privilege guest-group user accounts on Joomla CMS versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3, because the core profile.save controller never checks whether the requester is logged in, so the account-creation path succeeds even on sites where public user registration has been turned off. No CISA KEV listing and no public exploit code were identified at time of analysis. The vendor rates this 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) with a confidentiality-only low impact, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:N; both agree the attack is remote, unauthenticated and requires no user interaction or special configuration, and that the damage is bounded because only the lowest-privilege account level can be created, never an administrative or full registered-user account.
Cross-site scripting in Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 lets a high-privileged authenticated backend account inject an unescaped script payload that is rendered through the core generic audio and video media output layouts, executing in the browser of a second user who views the affected page. Because the vulnerable layouts do not escape user-influenced output, a rogue or compromised elevated account (for example a Manager or Super User) can plant the payload and wait for a victim to load the rendered media; exploitation therefore requires both PR:H authentication and victim page interaction, not anonymous remote access. There is no public exploit identified at time of analysis, no evidence of confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 vector marks exploit maturity as unproven (E:U) with a base score of 5.9.
Cross-site scripting in the HTML mail template feature of Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows attacker-influenced data to reach template fields that are emitted without escaping, so crafted content can execute script when the resulting HTML email is rendered in a browser-based preview or webmail client. Our assessment treats exploitation as requiring the HTML mail template feature to be in use plus an authenticated, operator-level party able to influence template fields and a victim who renders the message, even though the vendor's CVSS 4.0 vector carries PR:N/UI:N; the deliverability of the payload is further limited because many mail clients strip or sanitize inline script. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Joomla has published advisory 20260908 covering the fix.
Improper access-control enforcement in the Joomla CMS workflow feature allows an authenticated backend user to change the workflow stage of content that their assigned ACL should prevent them from touching, in Joomla 5.0.0-5.4.8 and 6.0.0-6.1.3. The CVSS 4.0 vector (5.1, AV:N/AC:L/PR:H) requires a valid backend account, and the impact is limited to the integrity of the workflow stage value (VC:L/VI:L, no availability effect), so this is a genuine but low-priority authorization flaw rather than an emergency. Confirmed actively exploited? No - no CISA KEV listing, and no public exploit code identified at time of analysis; the effect is only meaningful on sites that actually use Joomla's content workflow functionality.
Improper access-control checks in Joomla's tagged-item output let unauthenticated visitors read content items that belong to access-restricted categories, exposing only article content (confidentiality-only) with no modification or denial-of-service impact. Affected releases are Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3; exploitation requires no authentication and no user interaction (PR:N/UI:N in both the supplied CVSS 4.0 vector and our assessed CVSS 3.1 vector), so any anonymous visitor can trigger it on a default site that renders tagged items where tags span categories with differing view levels. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited; the practical risk is bounded because disclosure is limited to tagged items in restricted categories, which is why our independent assessment treats this as a genuine but low-to-moderate priority issue.
Stored cross-site scripting in the Joomla CMS module list layout allows an authenticated administrator-level backend user to supply values that are rendered without escaping, so script executes in the browser of another privileged user who views the module list. Affected releases are Joomla CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3, and the vendor-assigned CVSS 4.0 base score is 5.9. Because exploitation requires a pre-existing high-privilege account (PR:H) and a victim who opens the affected administrative view (UI:P), the issue is confined to the backend and cannot be triggered by anonymous front-end visitors; no public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and a vendor advisory covering the fixed releases is available from the Joomla Security Centre.
Improper access control in the Joomla CMS content history comparison view allows an authenticated backend user to read content revisions they are not authorized to view, affecting Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The issue is rated CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; consistent with the independent CVSS:3.1 vector of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so it is a genuine but low-severity confidentiality-only exposure: PR:H indicates the attacker must already hold a high-privileged, authenticated backend/administrator session, no victim interaction is required, and there is no integrity or availability impact. The leaked data is limited to stored content versions rather than credentials or system data, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Cross-site scripting in Joomla CMS core (HTMLHelper::link) allows an authenticated, high-privileged backend user to inject unescaped markup into links that later executes in a victim's browser when the affected page is rendered. All Joomla releases from 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3 are affected, so any site still running a legacy 1.5/2.5/3.x branch as well as current 5.x and 6.x installations needs attention. Exploitation requires a high-privilege Joomla account (CVSS PR:H) plus a victim who views the crafted link (UI:P/UI:R); no public exploit code exists and there is no indication of active exploitation (not listed in CISA KEV), and the E:U metric keeps the practical risk moderate despite the network attack vector.
Improper CORS origin validation in Joomla! CMS versions 4.0.0-5.4.7 and 6.0.0-6.1.2 allows remote attackers to bypass the configured origin allowlist and make unauthorized cross-origin requests. The CWE-93 (CRLF Injection) classification indicates the bypass mechanism likely involves injecting carriage-return/line-feed characters into the Origin header to confuse the server's string-comparison logic, rather than a simple misconfiguration of the allowlist itself. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, zero-privilege, low-complexity nature of the flaw makes it exploitable at scale against Joomla sites where CORS is configured.
Improper access control (CWE-284) in the custom fields webservice API of Joomla! CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 allows authenticated high-privilege users to create custom fields for components whose ACL restrictions should deny them access. The flaw represents an authorization bypass at the API layer - the REST webservice endpoints for custom fields do not enforce the same component-level ACL checks applied in the web UI, creating a privilege boundary discrepancy. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 with PR:H reflects that exploitation is constrained to already-authenticated, elevated users.
Cross-site scripting in Joomla! CMS versions 5.1.0-5.4.7 and 6.0.0-6.1.2 exposes sites to stored XSS through improperly escaped schema.org structured-data markup output. An attacker holding high-privilege CMS credentials can inject malicious script into schema.org content fields, which subsequently executes in the browsers of users who load affected pages. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; a vendor security advisory has been issued through the Joomla Security Centre.
Improper access control in Joomla! CMS 5.1.0-5.4.7 and 6.0.0-6.1.2 leaks restricted contact data into schema.org structured data snippets embedded in page output. The CMS fails to enforce ACL rules during schema.org contact snippet generation, allowing contact details for items that should be inaccessible to be injected into structured metadata visible in page source. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.
Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed.
Improper ACL enforcement in Joomla! CMS batch copy functionality allows authenticated backend users to copy content items they do not have edit permissions for, effectively bypassing content-level access controls. Affected versions span two active release branches: 4.0.0-5.4.7 and 6.0.0-6.1.2, covering a broad portion of active Joomla deployments. No public exploit code exists at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in active exploitation campaigns.
Joomla! CMS exposes a broken access control flaw on its webservices API category endpoints, permitting users who lack the requisite ACL permissions to create content categories they are explicitly not authorized to manage. The issue spans a large installed base across two major release lines: versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are confirmed affected. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, but the flaw is network-accessible, requires no complex conditions to trigger via the webservices interface, and was reported directly by the Joomla project.
Cross-site scripting in Joomla! CMS's com_installer component exposes the administrator backend to script injection via the update list view, stemming from missing output escaping (CWE-79). The CVSS 4.0 vector (PR:H/UI:P/E:U) confirms exploitation is constrained to sessions where a high-privilege administrator views the maliciously influenced update list, substantially limiting the attack surface. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Joomla! CMS's com_media webservice endpoints allows privileged users to overwrite media files even when they lack explicit editing permissions. The flaw affects two active release lines - 4.1.0 through 5.4.6 and 6.0.0 through 6.1.1 - and is confirmed by the Joomla Security Centre. The CVSS 4.0 vector (SC:H/SI:H/SA:H) indicates that while the direct impact on the vulnerable system is limited (VI:L), successful exploitation can cascade into high-impact consequences on the broader site or dependent systems. No public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect access control in Joomla! CMS exposes com_fields REST API webservices endpoints to users who lack the required permissions, allowing them to create custom field definitions that should be restricted to higher-privileged roles such as Manager or Administrator. The flaw originates from a missing or incorrectly evaluated ACL check in the webservices layer and is confirmed by Joomla's own Security Centre in advisory 20260712. No public exploit has been identified at time of analysis, though the CVSS scope-change metrics indicate potential for significant downstream impact to site content and dependent integrations if unauthorized field definitions are used to inject malicious markup.
Cross-site scripting in Joomla! CMS com_templates file management view allows a high-privileged attacker to inject unescaped malicious script that executes in the browser of any administrator who subsequently views the affected template file listing. Affected versions span Joomla! 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1. No public exploit identified at time of analysis and the CVSS 4.0 supplemental metric E:U confirms no known active exploitation, but the wide install base and admin-targeting nature of the payload make this relevant to Joomla site operators.
Unauthorized access to workflow stage and transition data in Joomla! CMS is possible due to an improper access check in the com_workflow component (CWE-284), allowing authenticated users who lack the necessary workflow management permissions to read internal content publication configuration. The CVSS 4.0 vector assigns high subsequent-system impacts (SC:H/SI:H/SA:H), suggesting the vendor assessed this metadata exposure as a meaningful enabler of broader content pipeline compromise. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Incorrect access control in Joomla! CMS's com_modules component exposes the module listing interface to frontend users who should not have visibility into installed modules. The flaw stems from CWE-284 (Improper Access Control), where the frontend fails to enforce sufficient privilege checks before returning module enumeration data. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided in source data, but the CVSS 4.0 score of 6.4 reflects meaningful subsequent-system impact potential stemming from reconnaissance value of the disclosed module inventory.
Improper access control in Joomla! CMS exposes com_privacy component webservice endpoints to users lacking the required authorization, allowing unauthorized reads of GDPR/privacy datasets. The flaw is classified as CWE-284 and impacts downstream systems at high severity per the vendor-supplied CVSS 4.0 vector, despite requiring high privileges on the vulnerable system itself - a tension that suggests role-boundary bypass rather than fully unauthenticated access. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in Joomla! CMS modalreturn layout components enables a high-privileged attacker to inject and execute arbitrary JavaScript in a victim administrator's browser session. The root cause is insufficient output escaping in multiple component layouts that handle modal return values. No public exploit code has been identified and CISA KEV does not list this vulnerability; the CVSS 4.0 exploitation likelihood metric (E:U) further indicates no observed active exploitation at time of analysis.
Cross-site scripting in Joomla! CMS's generic image output layout enables a high-privileged attacker to inject malicious script payloads that execute in the browsers of other authenticated users who view the affected content. The root cause is absent HTML output escaping in the image rendering component (CWE-79), allowing injected JavaScript to break out of the intended data context. No public exploit has been identified at time of analysis, and exploitation requires a pre-existing high-privileged Joomla account plus passive victim interaction, substantially limiting real-world exposure despite high impact scores on confidentiality and integrity.
Improper access control in Joomla! CMS com_contact component exposes restricted contact records via vcard (VCF) export to authenticated users who should not have access. Affecting versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.1, the flaw allows an authenticated user to bypass access restrictions and download vcard exports of contacts that have been explicitly restricted from their view. No public exploit code or active exploitation has been identified at time of analysis, but the wide deployment footprint of Joomla and the breadth of affected versions (spanning both the 3.x/5.x and 6.x branches) make patching a priority for sites using the com_contact component.
Cross-site scripting in Joomla! CMS multi-factor authentication management views allows a high-privileged attacker to inject persistent malicious scripts that execute in the browser of any administrator who subsequently views the MFA management interface. Affected versions span two major release lines: 4.2.0-5.4.6 and 6.0.0-6.1.1, representing a broad surface across both legacy and current deployments. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, successful exploitation yields high confidentiality and integrity impact against the victim administrator's browser session.
Stored XSS in Joomla CMS's language override administrative feature allows a high-privileged attacker to inject malicious scripts that execute in the browser of any user who subsequently renders the affected language string. Rooted in CWE-79 (improper output neutralization), the vulnerability requires an administrative account to place the payload but can then target other admins or front-end users. No public exploit code has been identified at time of analysis (CVSS E:U), and the vulnerability is not listed in the CISA KEV catalog.
Blind SQL injection in the com_finder (Smart Search) component of Joomla! CMS allows authenticated high-privilege users to extract confidential data from the underlying database across versions 5.4.0-5.4.5 and 6.0.0-6.1.0. The vulnerability stems from improperly constructed SQL filter clauses in search queries that permit attacker-controlled input to alter query logic. No public exploit has been identified at time of analysis, CISA has not added this to the KEV catalog, and EPSS probability sits at 0.03%, signaling minimal observed exploitation pressure.
CSRF token validation is absent on the admin user activation endpoint (com_users component) in Joomla! CMS 6.0.0 through 6.1.0, allowing a remote attacker to trigger unauthorized user activation actions by luring an authenticated administrator into visiting a crafted page. The CVSS 4.0 vector (PR:H/UI:A) confirms exploitation requires an active, logged-in administrator and deliberate user interaction, constraining real-world risk despite the network-accessible attack vector. No public exploit code exists and CISA has not added this to KEV; EPSS places exploitation probability at 0.02% (5th percentile), consistent with SSVC's 'none' exploitation status.
Authenticated blind SQL injection in Joomla! CMS's com_tags component allows high-privileged attackers to exfiltrate database contents by supplying maliciously crafted ORDER BY clauses that are not properly validated. Affected versions span two distinct release trains: the 4.x/5.x line (4.0.0 through 5.4.5) and the 6.x line (6.0.0 through 6.1.0), meaning the vulnerability persists across both legacy and current major releases. No public exploit code has been identified at time of analysis, and the EPSS score of 0.00% indicates negligible automated exploitation probability, though the high-privilege requirement significantly limits the realistic attacker pool.
Path traversal in Joomla! CMS com_media web service endpoint allows authenticated high-privilege attackers to read arbitrary files outside the intended web root via a manipulated search parameter. Affected versions span two major release trains: 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. No public exploit code exists and no active exploitation has been confirmed, but the vulnerability results in full confidentiality loss of the vulnerable system's filesystem contents accessible to the web process.
Cross-site scripting in Joomla! CMS's multilingual associations component (com_associations) allows an authenticated high-privilege attacker to inject malicious scripts that execute in another user's browser session, yielding high confidentiality impact on the vulnerable system. Affected installations span Joomla! CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. SSVC assessment lists exploitation as none, EPSS is 0.04% (13th percentile), and no public exploit code or CISA KEV listing exists, indicating this is a low-urgency but genuine privilege-escalation-adjacent risk in multi-administrator Joomla environments.
Privilege escalation in Joomla! CMS via the com_users batch task allows low-privileged authenticated users to bypass access controls and elevate their user group membership or permissions. Affected versions span two major release lines: 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0, as confirmed by ENISA EUVD-2026-31880 and the Joomla Security Centre. No public exploit has been identified and EPSS is effectively zero; however, SSVC assesses the technical impact as total, meaning successful exploitation could yield full privilege takeover within the application.
Improper access control in Joomla! CMS com_scheduler component permits low-privileged authenticated backend users to modify the task types of existing scheduler tasks, an operation that should be restricted to higher-privileged administrators. Affected versions span Joomla! 4.1.0 through 5.4.5 and 6.0.0 through 6.1.0. While no public exploit code exists and CISA KEV has not confirmed active exploitation, the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector indicate that tampering with scheduler task types can produce significant integrity and availability consequences beyond the immediately vulnerable component.
Stored cross-site scripting in Joomla! CMS feed modules allows a high-privileged authenticated attacker to inject unsanitized content that executes in the browser context of a victim user who passively views the affected feed output. Affecting the broad version spans of 3.0.0 through 5.4.5 and 6.0.0 through 6.1.0, the root cause is a failure to apply output escaping before rendering feed module data. No public exploit has been identified at time of analysis, and SSVC confirms no current active exploitation.
Reflected or stored cross-site scripting in Joomla! CMS com_content component allows a high-privileged attacker to inject unescaped output into readmore links, executing arbitrary JavaScript in a victim's browser upon interaction. Affected releases span Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0. No public exploit code has been identified and CISA KEV does not list this vulnerability, but a vendor security advisory has been published at the Joomla Security Centre.
Cross-site scripting in Joomla! CMS content history component (com_contenthistory) allows a high-privileged attacker to inject persistent malicious scripts due to missing output escaping, leading to confidentiality compromise of the vulnerable system when a victim views affected history entries. Confirmed affected versions span Joomla! CMS 3.0.0-5.4.5 and 6.0.0-6.1.0 across an exceptionally wide installed base. No public exploit code exists and the vulnerability is not in the CISA KEV catalog; EPSS of 0.04% (13th percentile) confirms no observed widespread exploitation at time of analysis.
SQL injection in Joomla CMS articles webservice endpoint allows remote attackers to execute arbitrary SQL queries through improperly constructed ORDER BY clauses, affecting all versions of Joomla CMS. The vulnerability exists in the com_content component's webservice endpoint and permits unauthenticated query manipulation. No CVSS score or patch version information is available at time of analysis, limiting severity quantification.
Joomla CMS fails to enforce authenticated user checks on the AJAX component in the administrative area, allowing potential authentication bypass and unauthorized access to sensitive functionality. Third-party developers expecting default access controls may expose administrative features to unauthenticated or unauthorized users. No CVSS score or public exploit code has been identified, but the vulnerability affects all Joomla CMS versions and requires immediate review of custom AJAX implementations that rely on implicit authentication enforcement.
Cross-site scripting (XSS) in Joomla CMS multilingual associations component allows unauthenticated remote attackers to inject malicious scripts via unescaped output in the comparison view. The vulnerability affects all versions of Joomla CMS and stems from improper output encoding in the com_associations component. No CVSS score is available; however, the CWE-79 classification confirms reflected or stored XSS capability.
Joomla CMS fails to properly escape article titles in output, enabling stored cross-site scripting (XSS) attacks across multiple locations. Attackers with article creation or editing privileges can inject malicious scripts into article titles that execute in the browsers of site visitors, potentially compromising user sessions, stealing credentials, or defacing content. The vulnerability affects all Joomla CMS versions and requires administrative action to remediate.