https://vulnogram.org/ Most recent CVEs assigned by Joomla! Project (joomla). https://vulnogram.org/seaview/icons/joomla.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-102783 https://vulnogram.org/CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and… Medium Network Exploitable Thu, 08 Oct 2026 12:37:54 GMT https://vulnogram.org/CVE-2026-102784 https://vulnogram.org/CVE-2026-102784 Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action an… High Network Exploitable Thu, 08 Oct 2026 12:32:09 GMT https://vulnogram.org/CVE-2026-102782 https://vulnogram.org/CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login req… Critical Network Exploitable Wed, 07 Oct 2026 08:06:03 GMT https://vulnogram.org/CVE-2026-102781 https://vulnogram.org/CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single handler behind every data-management operation thi… Medium Network Exploitable Wed, 07 Oct 2026 08:02:35 GMT https://vulnogram.org/CVE-2026-102779 https://vulnogram.org/CVE-2026-102779 Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-bindi… Medium Network Exploitable Mon, 05 Oct 2026 16:12:00 GMT https://vulnogram.org/CVE-2026-102777 https://vulnogram.org/CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with… Medium Network Exploitable Mon, 05 Oct 2026 16:11:44 GMT https://vulnogram.org/CVE-2026-102426 https://vulnogram.org/CVE-2026-102426 Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r… Medium Network Exploitable Mon, 05 Oct 2026 16:09:48 GMT https://vulnogram.org/CVE-2026-102778 https://vulnogram.org/CVE-2026-102778 Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared… Medium Network Exploitable Mon, 05 Oct 2026 16:09:09 GMT https://vulnogram.org/CVE-2026-102780 https://vulnogram.org/CVE-2026-102780 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend sav… Medium Network Exploitable Mon, 05 Oct 2026 16:08:52 GMT https://vulnogram.org/CVE-2026-102776 https://vulnogram.org/CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method,… Medium Network Exploitable Mon, 05 Oct 2026 16:07:48 GMT https://vulnogram.org/CVE-2026-102775 https://vulnogram.org/CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o… High Network Exploitable Mon, 05 Oct 2026 16:06:51 GMT https://vulnogram.org/CVE-2026-102428 https://vulnogram.org/CVE-2026-102428 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector. Critical Network Exploitable Mon, 05 Oct 2026 16:06:20 GMT https://vulnogram.org/CVE-2026-102427 https://vulnogram.org/CVE-2026-102427 Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywh… Critical Network Exploitable Wed, 30 Sep 2026 15:14:49 GMT https://vulnogram.org/CVE-2026-76570 https://vulnogram.org/CVE-2026-76570 Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, a… Critical Network Exploitable Wed, 30 Sep 2026 14:47:48 GMT https://vulnogram.org/CVE-2026-102424 https://vulnogram.org/CVE-2026-102424 Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For e… High Network Exploitable Tue, 29 Sep 2026 17:07:25 GMT https://vulnogram.org/CVE-2026-102425 https://vulnogram.org/CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shor… Critical Network Exploitable Tue, 29 Sep 2026 17:04:35 GMT https://vulnogram.org/CVE-2026-101126 https://vulnogram.org/CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted direc… Medium Network Exploitable Tue, 29 Sep 2026 17:02:38 GMT https://vulnogram.org/CVE-2026-101112 https://vulnogram.org/CVE-2026-101112 Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla… Medium Network Exploitable Tue, 29 Sep 2026 17:00:26 GMT https://vulnogram.org/CVE-2026-101127 https://vulnogram.org/CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipa… High Network Exploitable Tue, 29 Sep 2026 16:57:36 GMT https://vulnogram.org/CVE-2026-90915 https://vulnogram.org/CVE-2026-90915 Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in ar… High Tue, 29 Sep 2026 16:45:45 GMT https://vulnogram.org/CVE-2026-92226 https://vulnogram.org/CVE-2026-92226 Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items. High Tue, 29 Sep 2026 16:45:40 GMT https://vulnogram.org/CVE-2026-92224 https://vulnogram.org/CVE-2026-92224 Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector. Medium Tue, 29 Sep 2026 16:43:40 GMT https://vulnogram.org/CVE-2026-90907 https://vulnogram.org/CVE-2026-90907 Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on… Medium Network Exploitable Tue, 29 Sep 2026 16:43:24 GMT https://vulnogram.org/CVE-2026-90914 https://vulnogram.org/CVE-2026-90914 Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts. Medium Tue, 29 Sep 2026 16:42:23 GMT https://vulnogram.org/CVE-2026-92231 https://vulnogram.org/CVE-2026-92231 Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex… High Tue, 29 Sep 2026 16:40:58 GMT https://vulnogram.org/CVE-2026-90918 https://vulnogram.org/CVE-2026-90918 Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Medium Network Exploitable Tue, 29 Sep 2026 16:38:58 GMT https://vulnogram.org/CVE-2026-92222 https://vulnogram.org/CVE-2026-92222 Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors. High Tue, 29 Sep 2026 16:38:49 GMT https://vulnogram.org/CVE-2026-92223 https://vulnogram.org/CVE-2026-92223 Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents. Medium Tue, 29 Sep 2026 16:38:34 GMT https://vulnogram.org/CVE-2026-90917 https://vulnogram.org/CVE-2026-90917 Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories. Medium Network Exploitable Tue, 29 Sep 2026 16:38:00 GMT https://vulnogram.org/CVE-2026-92225 https://vulnogram.org/CVE-2026-92225 Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector. Medium Tue, 29 Sep 2026 16:37:05 GMT https://vulnogram.org/CVE-2026-92227 https://vulnogram.org/CVE-2026-92227 Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability. High Network Exploitable Tue, 29 Sep 2026 16:36:45 GMT https://vulnogram.org/CVE-2026-92232 https://vulnogram.org/CVE-2026-92232 Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circu… High Tue, 29 Sep 2026 16:36:37 GMT https://vulnogram.org/CVE-2026-90916 https://vulnogram.org/CVE-2026-90916 Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents. Medium Tue, 29 Sep 2026 16:36:35 GMT https://vulnogram.org/CVE-2026-90913 https://vulnogram.org/CVE-2026-90913 Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints. High Tue, 29 Sep 2026 16:36:15 GMT https://vulnogram.org/CVE-2026-90906 https://vulnogram.org/CVE-2026-90906 Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper. Medium Tue, 29 Sep 2026 16:34:27 GMT https://vulnogram.org/CVE-2026-101111 https://vulnogram.org/CVE-2026-101111 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML a… Medium Network Exploitable Mon, 28 Sep 2026 18:48:04 GMT https://vulnogram.org/CVE-2026-101109 https://vulnogram.org/CVE-2026-101109 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of… Medium Network Exploitable Mon, 28 Sep 2026 18:44:12 GMT https://vulnogram.org/CVE-2026-101110 https://vulnogram.org/CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function called protectInjectionWithou… Critical Network Exploitable Mon, 28 Sep 2026 18:42:33 GMT https://vulnogram.org/CVE-2026-100753 https://vulnogram.org/CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering f… Medium Network Exploitable Mon, 28 Sep 2026 18:41:14 GMT https://vulnogram.org/CVE-2026-100752 https://vulnogram.org/CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and… Critical Network Exploitable Mon, 28 Sep 2026 18:41:00 GMT https://vulnogram.org/CVE-2026-101108 https://vulnogram.org/CVE-2026-101108 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (categor… Critical Network Exploitable Mon, 28 Sep 2026 18:39:32 GMT https://vulnogram.org/CVE-2026-100750 https://vulnogram.org/CVE-2026-100750 Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in… High Mon, 28 Sep 2026 07:00:40 GMT https://vulnogram.org/CVE-2026-100751 https://vulnogram.org/CVE-2026-100751 Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browse… High Mon, 28 Sep 2026 06:52:13 GMT https://vulnogram.org/CVE-2026-100748 https://vulnogram.org/CVE-2026-100748 Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 Medium Network Exploitable Sun, 27 Sep 2026 11:51:46 GMT https://vulnogram.org/CVE-2026-97164 https://vulnogram.org/CVE-2026-97164 Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` parameter of the `cache.process` task, you can recursively delete any directories that the web serv… High Sun, 27 Sep 2026 11:51:32 GMT https://vulnogram.org/CVE-2026-100747 https://vulnogram.org/CVE-2026-100747 Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name. Medium Sun, 27 Sep 2026 11:50:07 GMT https://vulnogram.org/CVE-2026-100749 https://vulnogram.org/CVE-2026-100749 Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted. Medium Sun, 27 Sep 2026 11:45:36 GMT https://vulnogram.org/CVE-2026-97165 https://vulnogram.org/CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated. Medium Network Exploitable Sun, 27 Sep 2026 11:44:38 GMT https://vulnogram.org/CVE-2026-97161 https://vulnogram.org/CVE-2026-97161 Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 Critical Network Exploitable Sat, 26 Sep 2026 14:35:24 GMT https://vulnogram.org/CVE-2026-97163 https://vulnogram.org/CVE-2026-97163 Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 Critical Network Exploitable Sat, 26 Sep 2026 14:33:44 GMT