Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

352,157

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,125

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 241–270 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-27753	—	—	Extension - rsjoomla.com - A SQLi vulnerability RSMediaGallery component 1.7.4 - 2.1.6 for Joomla	Jun 5, 2025 1y ago
CVE-2025-30084	—	—	Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for Joomla	Jun 5, 2025 1y ago
CVE-2025-25228	—	—	Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla	Apr 21, 2025 1y ago
CVE-2025-25226	—	—	[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package	Apr 8, 2025 1y ago
CVE-2025-25227	—	—	[20250402] - Joomla Core - MFA Authentication Bypass	Apr 8, 2025 1y ago
CVE-2025-2714	medium	5.3/10	JoomlaUX JUX Real Estate addagent cross site scripting	Mar 24, 2025 1y ago
CVE-2025-25225	—	—	Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla	Mar 15, 2025 1y ago
CVE-2025-2127	medium	5.3/10	JoomlaUX JUX Real Estate realties cross site scripting	Mar 9, 2025 1y ago
CVE-2025-2126	medium	5.3/10	JoomlaUX JUX Real Estate GET Parameter realties sql injection	Mar 9, 2025 1y ago
CVE-2025-22212	—	—	Extension - tassos.gr - SQL injection in Convert Forms component version 1.0.0-1.0.0 - 4.4.9 for Joomla	Mar 5, 2025 1y ago
CVE-2025-22211	—	—	Extension - webdesigner-profi.de - SQL injection in JoomShopping component version 1.0.0 - 5.5.5 for Joomla	Feb 25, 2025 1y ago
CVE-2025-22210	—	—	Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla	Feb 25, 2025 1y ago
CVE-2025-22208	—	—	Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla	Feb 15, 2025 1y ago
CVE-2025-22209	—	—	Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla	Feb 15, 2025 1y ago
CVE-2025-22206	—	—	Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomla	Feb 4, 2025 1y ago
CVE-2025-22205	—	—	Extension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomla	Feb 4, 2025 1y ago
CVE-2025-22204	—	—	Extension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for Joomla	Feb 4, 2025 1y ago
CVE-2024-40745	—	—	Extension - tassos.gr - Reflected Cross site scripting vulnerability in Convert Forms component for Joomla < 4.4.8	Dec 4, 2024 1y ago
CVE-2024-40744	—	—	Extension - tassos.gr - Unrestricted file upload in Convert Forms component for Joomla < 4.4.8	Dec 4, 2024 1y ago
CVE-2024-40746	—	—	Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1	Oct 21, 2024 1y ago
CVE-2024-27183	—	—	Extension - dj-extensions.com - XSS vulnerability in DJ-HelpfulArticles component for Joomla 1.0.0-1.1.0	Jul 9, 2024 2y ago
CVE-2024-5737	medium	6.3/10	HTML Injection in AdmirorFrames Joomla! Extension	Jun 28, 2024 2y ago
CVE-2024-5736	high	8.2/10	SSRF in AdmirorFrames Joomla! Extension	Jun 28, 2024 2y ago
CVE-2024-5735	medium	6.3/10	Full Path Disclosure in AdmirorFrames Joomla! Extension	Jun 28, 2024 2y ago
CVE-2024-32788	medium	5.3/10	WordPress FG Joomla to Wordpress plugin <= 4.20.2 - Sensitive Data Exposure via Log File vulnerability	Apr 24, 2024 2y ago
CVE-2024-24837	medium	4.3/10	Cross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress plugins	Feb 21, 2024 2y ago
CVE-2024-21728	—	—	Extension - smartcalc.es - Open redirect vulnerability in osTicky component for Joomla <= 2.2.8	Feb 15, 2024 2y ago
CVE-2024-21727	—	—	Extension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14	Feb 15, 2024 2y ago
CVE-2023-40627	—	—	Extension - MLWebTechnologies - Reflected XSS in LivingWord component for Joomla 1.0.0-3.0.0	Dec 14, 2023 2y ago
CVE-2023-40659	—	—	Extension - joomboost.com - Reflected XSS in Easy Quick Contact module for Joomla 1.0.0-1.3.0	Dec 14, 2023 2y ago