Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

356,134

All time

Critical · Active

12,718

CVSS ≥ 9.0

New · 14 days

2,320

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 241–270 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-54295	medium	5.1/10	Extension - dj-extensions.com - Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla	Jul 23, 2025 1y ago
CVE-2025-54296	high	7.0/10	Extension - mooj.org - Stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla	Jul 23, 2025 1y ago
CVE-2025-50127	high	8.5/10	Extension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla	Jul 23, 2025 1y ago
CVE-2025-49484	high	8.7/10	Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla	Jul 18, 2025 1y ago
CVE-2025-50126	medium	5.3/10	Extension - rsjoomla.com - Stored XSS vulnerability RSBlog! component 1.11.6-1.14.5 for Joomla	Jul 18, 2025 1y ago
CVE-2025-50058	medium	5.1/10	Extension - rsjoomla.com - Stored XSS vulnerability in RSDirectory! component 1.16.3-1.17.7 for Joomla	Jul 18, 2025 1y ago
CVE-2025-50057	medium	6.9/10	Extension - rsjoomla.com - DOS vulnerability RSFiles! component 1.16.3-1.17.7 for Joomla	Jul 18, 2025 1y ago
CVE-2025-50056	medium	5.1/10	Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.28 for Joomla	Jul 18, 2025 1y ago
CVE-2025-49485	high	8.6/10	Extension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for Joomla	Jul 18, 2025 1y ago
CVE-2025-49486	high	8.6/10	Extension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for Joomla	Jul 18, 2025 1y ago
CVE-2025-26855	—	—	Extension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for Joomla	Jul 18, 2025 1y ago
CVE-2025-26854	—	—	Extension - joomcar.net - SQL injection in Articles Good Search 1.0.0 - 1.2.4.0011 for Joomla	Jul 18, 2025 1y ago
CVE-2025-49468	high	8.6/10	Joomla Extension - nobossextensions.com - SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla	Jun 13, 2025 1y ago
CVE-2025-49467	critical	9.3/10	Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla	Jun 12, 2025 1y ago
CVE-2025-30085	critical	9.2/10	Extension - rsjoomla.com - Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla	Jun 11, 2025 1y ago
CVE-2025-32466	medium	6.7/10	Extension - rsjoomla.com - SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla	Jun 11, 2025 1y ago
CVE-2025-32465	high	8.5/10	Extension - rsjoomla.com - Stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla	Jun 11, 2025 1y ago
CVE-2025-27754	—	—	Extension - rsjoomla.com - A stored XSS vulnerability RSBlog! component 1.11.6 - 1.14.4 for Joomla	Jun 5, 2025 1y ago
CVE-2025-27753	—	—	Extension - rsjoomla.com - A SQLi vulnerability RSMediaGallery component 1.7.4 - 2.1.6 for Joomla	Jun 5, 2025 1y ago
CVE-2025-30084	—	—	Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for Joomla	Jun 5, 2025 1y ago
CVE-2025-25228	—	—	Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla	Apr 21, 2025 1y ago
CVE-2025-25226	—	—	[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package	Apr 8, 2025 1y ago
CVE-2025-25227	—	—	[20250402] - Joomla Core - MFA Authentication Bypass	Apr 8, 2025 1y ago
CVE-2025-2714	medium	5.3/10	JoomlaUX JUX Real Estate addagent cross site scripting	Mar 24, 2025 1y ago
CVE-2025-25225	—	—	Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla	Mar 15, 2025 1y ago
CVE-2025-2127	medium	5.3/10	JoomlaUX JUX Real Estate realties cross site scripting	Mar 9, 2025 1y ago
CVE-2025-2126	medium	5.3/10	JoomlaUX JUX Real Estate GET Parameter realties sql injection	Mar 9, 2025 1y ago
CVE-2025-22212	—	—	Extension - tassos.gr - SQL injection in Convert Forms component version 1.0.0-1.0.0 - 4.4.9 for Joomla	Mar 5, 2025 1y ago
CVE-2025-22211	—	—	Extension - webdesigner-profi.de - SQL injection in JoomShopping component version 1.0.0 - 5.5.5 for Joomla	Feb 25, 2025 1y ago
CVE-2025-22210	—	—	Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla	Feb 25, 2025 1y ago