Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

339,687

All time

Critical · Active

10,849

CVSS ≥ 9.0

New · 14 days

2,595

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-63082	medium	5.9/10	Joomla! Core - [20260101] - Inadequate content filtering for data URLs	Jan 6, 2026 6mo ago
CVE-2025-63083	medium	5.9/10	Joomla! Core - [20260102] - XSS vector in the pagebreak plugin	Jan 6, 2026 6mo ago
CVE-2025-55758	—	—	Extension - jdownloads.com - CSRF vectors in jDownloads component 1.0.0 - 4.0.47 for Joomla	Oct 28, 2025 8mo ago
CVE-2025-55757	—	—	Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla	Oct 25, 2025 8mo ago
CVE-2025-54477	—	—	Joomla! Core - [20250902] User-Enumeration in passkey authentication method	Sep 30, 2025 9mo ago
CVE-2025-54476	medium	4.8/10	Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code	Sep 30, 2025 9mo ago
CVE-2025-54300	high	8.5/10	Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla	Aug 25, 2025 10mo ago
CVE-2025-54301	high	8.5/10	Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla	Aug 25, 2025 10mo ago
CVE-2025-54475	high	8.7/10	Extension - joomsky.com - SQL injection in JS jobs component version 1.3.2 - 1.4.4 for Joomla	Aug 15, 2025 11mo ago
CVE-2025-54474	high	8.5/10	Extension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla	Aug 15, 2025 11mo ago
CVE-2025-54473	critical	9.2/10	Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla	Aug 15, 2025 11mo ago
CVE-2025-54299	critical	9.4/10	Extension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla	Jul 28, 2025 11mo ago
CVE-2025-54298	critical	9.4/10	Extension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla	Jul 28, 2025 11mo ago
CVE-2025-54297	high	7.0/10	Extension - compojoom.com - Stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla	Jul 23, 2025 11mo ago
CVE-2025-54294	critical	9.3/10	Extension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for Joomla	Jul 23, 2025 11mo ago
CVE-2025-54295	medium	5.1/10	Extension - dj-extensions.com - Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla	Jul 23, 2025 11mo ago
CVE-2025-54296	high	7.0/10	Extension - mooj.org - Stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla	Jul 23, 2025 11mo ago
CVE-2025-50127	high	8.5/10	Extension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla	Jul 23, 2025 11mo ago
CVE-2025-49484	high	8.7/10	Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-50126	medium	5.3/10	Extension - rsjoomla.com - Stored XSS vulnerability RSBlog! component 1.11.6-1.14.5 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-50058	medium	5.1/10	Extension - rsjoomla.com - Stored XSS vulnerability in RSDirectory! component 1.16.3-1.17.7 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-50057	medium	6.9/10	Extension - rsjoomla.com - DOS vulnerability RSFiles! component 1.16.3-1.17.7 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-50056	medium	5.1/10	Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.28 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-49485	high	8.6/10	Extension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-49486	high	8.6/10	Extension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-26855	—	—	Extension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-26854	—	—	Extension - joomcar.net - SQL injection in Articles Good Search 1.0.0 - 1.2.4.0011 for Joomla	Jul 18, 2025 12mo ago
CVE-2025-49468	high	8.6/10	Joomla Extension - nobossextensions.com - SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla	Jun 13, 2025 1y ago
CVE-2025-49467	critical	9.3/10	Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla	Jun 12, 2025 1y ago
CVE-2025-30085	critical	9.2/10	Extension - rsjoomla.com - Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla	Jun 11, 2025 1y ago