Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

339,657

All time

Critical · Active

10,847

CVSS ≥ 9.0

New · 14 days

2,644

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2018-25381	high	7.1/10	Joomla Responsive Portfolio 1.6.1 SQL Injection via filter parameters	May 25, 2026 1mo ago
CVE-2018-25380	high	7.1/10	Joomla Component eXtroForms 2.1.5 SQL Injection via filter parameters	May 25, 2026 1mo ago
CVE-2018-25354	medium	5.3/10	Joomla Component jomres 9.11.2 Cross-Site Request Forgery	May 23, 2026 1mo ago
CVE-2018-25351	high	8.8/10	Joomla! Component EkRishta 2.10 SQL Injection via username	May 23, 2026 1mo ago
CVE-2018-25348	high	8.8/10	Joomla! Component Ek Rishta 2.10 SQL Injection via user_detail	May 23, 2026 1mo ago
CVE-2018-25337	medium	5.3/10	Joomla JoomOCShop 1.0 Cross-Site Request Forgery	May 17, 2026 2mo ago
CVE-2018-25330	high	8.8/10	Joomla! EkRishta 2.10 Persistent XSS and SQL Injection	May 17, 2026 2mo ago
CVE-2018-25327	medium	6.9/10	Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery	May 17, 2026 2mo ago
CVE-2020-37226	high	7.1/10	Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby	May 13, 2026 2mo ago
CVE-2020-37224	high	7.1/10	Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby	May 13, 2026 2mo ago
CVE-2020-37219	high	8.7/10	Joomla com_fabrik 3.9.11 Directory Traversal via image.php	May 13, 2026 2mo ago
CVE-2020-37218	high	8.8/10	Joomla com_hdwplayer 4.2 SQL Injection via search.php	May 13, 2026 2mo ago
CVE-2026-23900	—	—	Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla	Apr 11, 2026 3mo ago
CVE-2023-54364	medium	5.1/10	Joomla HikaShop 4.7.4 Reflected XSS via Product Filter	Apr 9, 2026 3mo ago
CVE-2023-54363	medium	5.1/10	Joomla Solidres 2.13.3 Reflected XSS via Multiple Parameters	Apr 9, 2026 3mo ago
CVE-2023-54362	medium	5.1/10	Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword	Apr 9, 2026 3mo ago
CVE-2023-54361	medium	5.1/10	Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword	Apr 9, 2026 3mo ago
CVE-2023-54360	medium	5.1/10	Joomla JLex Review 6.0.1 Reflected XSS via review_id Parameter	Apr 9, 2026 3mo ago
CVE-2026-21630	medium	6.9/10	Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint	Apr 1, 2026 3mo ago
CVE-2026-23898	high	8.6/10	Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate	Apr 1, 2026 3mo ago
CVE-2026-21629	medium	6.3/10	Joomla! Core - [20260301] - ACL hardening in com_ajax	Apr 1, 2026 3mo ago
CVE-2026-23899	high	8.6/10	Joomla! Core - [20260306] - Improper access check in webservice endpoints	Apr 1, 2026 3mo ago
CVE-2026-21631	medium	5.9/10	Joomla! Core - [20260303] - XSS vector in com_associations comparison view	Apr 1, 2026 3mo ago
CVE-2026-21632	medium	5.9/10	Joomla! Core - [20260304] - XSS vectors in various article title outputs	Apr 1, 2026 3mo ago
CVE-2026-21628	critical	10.0/10	Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla	Mar 5, 2026 4mo ago
CVE-2026-21627	critical	9.5/10	Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla	Feb 20, 2026 4mo ago
CVE-2026-21626	critical	9.2/10	Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla	Feb 6, 2026 5mo ago
CVE-2026-21625	medium	4.8/10	Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla	Jan 16, 2026 6mo ago
CVE-2026-21624	critical	9.4/10	Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla	Jan 16, 2026 6mo ago
CVE-2026-21623	critical	9.4/10	Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla	Jan 16, 2026 6mo ago