13
CVEs
2
Critical
5
High
0
KEV
0
PoC
7
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
5
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (30)
PHP
23
Open Redirect
6
Jux Real Estate
3
Js Jobs
3
Easydiscuss
3
Fedora
2
Hikashop
2
Debian Linux
2
Phpmailer
1
Financial Services Loan Loss Forecasting And Provisioning
1
Snapcenter
1
Bi Publisher
1
Knowledge
1
Healthcare Translational Research
1
Healthcare Foundation
1
Insurance Ifrs 17 Analyzer
1
Retail Back Office
1
Insurance Performance Insight
1
Cloudforms
1
Junos
1
Financial Services Institutional Performance Analytics
1
Communications Session Report Manager
1
Business Process Management Suite
1
Leap
1
Agile Product Lifecycle Management For Process
1
Financial Services Retail Performance Analytics
1
Hospitality Simphony
1
Financial Services Balance Sheet Planning
1
Enterprise Session Border Controller
1
Financial Services Market Risk Measurement And Management
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-40636 | SQL injection in Joomla mod_vvisit_counter v2.0.4j3. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-21625 | Arbitrary file upload in Joomla's Easy Discuss component allows authenticated attackers to bypass file validation by spoofing extensions, since the component relies solely on extension checks without verifying MIME types. An attacker with user privileges can upload malicious files to achieve remote code execution on affected systems. No patch is currently available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2025-63082 | Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. [CVSS 6.1 MEDIUM] | MEDIUM | 6.1 | 0.0% | 31 |
No patch
|
| CVE-2025-63083 | Lack of output escaping leads to a XSS vector in the pagebreak plugin. [CVSS 6.1 MEDIUM] | MEDIUM | 6.1 | 0.0% | 31 |
No patch
|
| CVE-2026-21623 | Stored cross-site scripting in Joomla's Easy Discuss component allows authenticated users to inject malicious scripts into forum posts due to insufficient input validation. An attacker with login credentials can execute arbitrary JavaScript in the browsers of other users viewing affected posts, potentially leading to session hijacking or credential theft. No patch is currently available for this vulnerability. | MEDIUM | 5.4 | 0.0% | 27 |
No patch
|
| CVE-2026-21624 | Insufficient input validation in the Easy Discuss component for Joomla allows authenticated users to inject persistent cross-site scripting (XSS) payloads through user avatar text fields. An attacker with valid credentials can exploit this to execute malicious scripts in the browsers of other users viewing affected content. The vulnerability affects Joomla installations using the vulnerable Easy Discuss component, with no patch currently available. | MEDIUM | 5.4 | 0.0% | 27 |
No patch
|
| CVE-2026-21627 | The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction. | – | 0.0% | 0 |
No patch
|
|
| CVE-2025-54473 | An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 9.2 | 0.1% | – |
No patch
|
| CVE-2025-54474 | A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.5 | 0.1% | – |
No patch
|
| CVE-2025-54475 | A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.7 | 0.0% | – |
No patch
|
| CVE-2025-54300 | A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.5 | 0.1% | – |
No patch
|
| CVE-2025-54301 | A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.5 | 0.1% | – |
No patch
|
| CVE-2025-48108 | Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.2.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | MEDIUM | 6.5 | 0.0% | – |
No patch
|