Skip to content
Noroxi

joomla records

1,002 published records for vendor joomla.

Researcher profile

Entered KEV
2 · 0.2%
Weaponized
13 · 1.3%
Pre-auth RCE
458
With a fix record
3.5%
Median publish → KEV
1719 days

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

1,002 records
  • CVE-2016-10033
    99Now

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    phpmailer project · phpmailerDec 30, 2016

  • CVE-2023-23752
    81Now

    [20230201] - Core - Improper access check in webservice endpoints

    MediumCVSS 5.3KEVWeaponizedEPSS 100%

    joomla · joomla\!Feb 16, 2023

  • CVE-2017-8917
    69This week

    SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.

    CriticalCVSS 9.8WeaponizedEPSS 100%

    joomla · joomla\!May 17, 2017

  • CVE-2016-10045
    68This week

    The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently e

    CriticalCVSS 9.8WeaponizedEPSS 98%

    phpmailer project · phpmailerDec 30, 2016

  • CVE-2016-8869
    68This week

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote

    CriticalCVSS 9.8WeaponizedEPSS 97%

    joomla · joomla\!Nov 4, 2016

  • CVE-2015-7297
    60This week

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a

    HighCVSS 7.5WeaponizedEPSS 100%

    joomla · joomla\!Oct 29, 2015

  • CVE-2015-8562
    59Plan

    Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via t

    HighCVSS 7.5WeaponizedEPSS 98%

    joomla · joomla\!Dec 16, 2015

  • CVE-2008-5053
    59Plan

    PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows rem

    CriticalCVSS 10.0Proof of conceptEPSS 64%

    joomla · com rssreaderNov 13, 2008

  • CVE-2015-7857
    58Plan

    SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 be

    HighCVSS 7.5WeaponizedEPSS 94%

    joomla · joomla\!Oct 29, 2015

  • CVE-2015-7858
    56Plan

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a

    HighCVSS 7.5WeaponizedEPSS 86%

    joomla · joomla\!Oct 29, 2015

  • CVE-2016-8870
    56Plan

    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registr

    HighCVSS 8.1WeaponizedEPSS 81%

    joomla · joomla\!Nov 4, 2016

  • CVE-2019-10945
    51Plan

    An issue was discovered in Joomla! before 3.9.5.

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    joomla · joomla\!Apr 10, 2019

  • CVE-2019-11358
    50Plan

    jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp

    MediumCVSS 6.1Proof of conceptEPSS 87%

    jquery · jqueryApr 19, 2019

  • CVE-2021-26030
    49Plan

    [20210401] - Core - Escape xss in logo parameter error pages

    MediumCVSS 6.1No exploitEPSS 82%

    joomla · joomla\!Apr 14, 2021

  • CVE-2021-23124
    48Plan

    [20210102] - Core - XSS in mod_breadcrumbs aria-label attribute

    MediumCVSS 6.1No exploitEPSS 79%

    joomla · joomla\!Jan 12, 2021

  • CVE-2020-35613
    48Plan

    [20201104] - Core - SQL injection in com_users list view

    CriticalCVSS 9.8No exploitEPSS 29%

    joomla · joomla\!Dec 28, 2020

  • CVE-2014-7228
    47Plan

    Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla!

    HighCVSS 7.5WeaponizedEPSS 55%

    joomla · joomla\!Nov 3, 2014

  • CVE-2008-6221
    46Plan

    PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for Joomla! allows remo

    HighCVSS 7.5Proof of conceptEPSS 54%

    joomla · joomlaFeb 20, 2009

  • CVE-2008-1505
    44Plan

    PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joomla! allows remote a

    HighCVSS 7.5Proof of conceptEPSS 46%

    joomla · joomlaMar 25, 2008

  • CVE-2010-5286
    44Plan

    Directory traversal vulnerability in Jstore (com_jstore) component for Joomla! allows remote attackers to read arbitrary files and possibly

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    joomla · joomla\!Nov 26, 2012

  • CVE-2008-5789
    43Plan

    Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5 for Joomla! allow re

    HighCVSS 7.5Proof of conceptEPSS 45%

    recly · interactive feederatorDec 31, 2008

  • CVE-2007-5065
    43Plan

    PHP remote file inclusion vulnerability in admin.slideshow1.php in the Flash Slide Show (com_slideshow) component for Joomla! allows remote

    HighCVSS 7.5Proof of conceptEPSS 42%

    joomla · joomlaSep 24, 2007

  • CVE-2018-8045
    43Plan

    In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User

    HighCVSS 8.8Proof of conceptEPSS 28%

    joomla · joomla\!Mar 14, 2018

  • CVE-2007-1699
    43Plan

    Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 component for Mambo and Joomla! allo

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    joomla · swmenu componentMar 26, 2007

  • CVE-2008-4668
    42Plan

    Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and

    CriticalCVSS 9.0Proof of conceptEPSS 21%

    joomla · com imagebrowserOct 22, 2008