Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

356,134

All time

Critical · Active

12,718

CVSS ≥ 9.0

New · 14 days

2,322

Newly disclosed

Feed last synced

55 mins ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-54362	medium	5.1/10	Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword	Apr 9, 2026 6mo ago
CVE-2023-54361	medium	5.1/10	Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword	Apr 9, 2026 6mo ago
CVE-2023-54360	medium	5.1/10	Joomla JLex Review 6.0.1 Reflected XSS via review_id Parameter	Apr 9, 2026 6mo ago
CVE-2026-21630	medium	6.9/10	Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint	Apr 1, 2026 6mo ago
CVE-2026-23898	high	8.6/10	Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate	Apr 1, 2026 6mo ago
CVE-2026-21629	medium	6.3/10	Joomla! Core - [20260301] - ACL hardening in com_ajax	Apr 1, 2026 6mo ago
CVE-2026-23899	high	8.6/10	Joomla! Core - [20260306] - Improper access check in webservice endpoints	Apr 1, 2026 6mo ago
CVE-2026-21631	medium	5.9/10	Joomla! Core - [20260303] - XSS vector in com_associations comparison view	Apr 1, 2026 6mo ago
CVE-2026-21632	medium	5.9/10	Joomla! Core - [20260304] - XSS vectors in various article title outputs	Apr 1, 2026 6mo ago
CVE-2026-21628	critical	10.0/10	Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla	Mar 5, 2026 7mo ago
CVE-2026-21627	critical	9.5/10	Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla	Feb 20, 2026 8mo ago
CVE-2026-21626	critical	9.2/10	Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla	Feb 6, 2026 8mo ago
CVE-2026-21625	medium	4.8/10	Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla	Jan 16, 2026 9mo ago
CVE-2026-21624	critical	9.4/10	Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla	Jan 16, 2026 9mo ago
CVE-2026-21623	critical	9.4/10	Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla	Jan 16, 2026 9mo ago
CVE-2025-63082	medium	5.9/10	Joomla! Core - [20260101] - Inadequate content filtering for data URLs	Jan 6, 2026 9mo ago
CVE-2025-63083	medium	5.9/10	Joomla! Core - [20260102] - XSS vector in the pagebreak plugin	Jan 6, 2026 9mo ago
CVE-2025-55758	—	—	Extension - jdownloads.com - CSRF vectors in jDownloads component 1.0.0 - 4.0.47 for Joomla	Oct 28, 2025 11mo ago
CVE-2025-55757	—	—	Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla	Oct 25, 2025 11mo ago
CVE-2025-54477	—	—	Joomla! Core - [20250902] User-Enumeration in passkey authentication method	Sep 30, 2025 1y ago
CVE-2025-54476	medium	4.8/10	Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code	Sep 30, 2025 1y ago
CVE-2025-54300	high	8.5/10	Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla	Aug 25, 2025 1y ago
CVE-2025-54301	high	8.5/10	Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla	Aug 25, 2025 1y ago
CVE-2025-54475	high	8.7/10	Extension - joomsky.com - SQL injection in JS jobs component version 1.3.2 - 1.4.4 for Joomla	Aug 15, 2025 1y ago
CVE-2025-54474	high	8.5/10	Extension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla	Aug 15, 2025 1y ago
CVE-2025-54473	critical	9.2/10	Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla	Aug 15, 2025 1y ago
CVE-2025-54299	critical	9.4/10	Extension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla	Jul 28, 2025 1y ago
CVE-2025-54298	critical	9.4/10	Extension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla	Jul 28, 2025 1y ago
CVE-2025-54297	high	7.0/10	Extension - compojoom.com - Stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla	Jul 23, 2025 1y ago
CVE-2025-54294	critical	9.3/10	Extension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for Joomla	Jul 23, 2025 1y ago