Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,224 results · page 2 of 25
Jun 19, 2026Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mCVE-2017-20275 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_phpbridge&view=phpview parameters and inject SQL code in the id parameter to extract database information including table and column names.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 19, 2026Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliCVE-2017-20270 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username and id parameters. Attackers can send GET requests to index.php with option=com_twitchtv and view parameters containing SQL injection payloads to extract sensitive database information including credentials and configuration data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraindropsinfotech.comextensions.joomla.org
Jun 19, 2026Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component UCVE-2017-20269 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component URL path. Attackers can supply malicious SQL code in the kissgallery endpoint to execute arbitrary database queries and extract sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordterrywcarter.comextensions.joomla.org
Jun 19, 2026Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injeCVE-2017-20268 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'eid' parameter. Attackers can send GET requests to the RSVP plugin endpoint with crafted SQL payloads to extract sensitive database information including database names and table structures.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgexploit-db.com
Jun 19, 2026Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the categoCVE-2017-20267 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the category_id parameter. Attackers can send GET requests to the events view with malicious SQL code in the category_id parameter to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomlathat.comextensions.joomla.org
Jun 19, 2026Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliCVE-2017-20265 · Websites & servers · reported by VulnCheckHigh 7.1
Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_flipwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpulseextensions.comextensions.joomla.org
Jun 19, 2026Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mCVE-2017-20264 · Websites & servers · reported by VulnCheckHigh 7.1
Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_sponsorwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information including credentials and configuration data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpulseextensions.comextensions.joomla.org
Jun 19, 2026Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inCVE-2017-20263 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_focalpoint, view=location, and a crafted id parameter containing SQL commands to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfocalpointx.comfocalpointx.com
Jun 19, 2026Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliCVE-2017-20262 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter. Attackers can send GET requests to index.php with the option=com_ajaxquiz and view=ajaxquiz parameters to extract sensitive database information including table names and column structures.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwebkul.comextensions.joomla.org
Jun 19, 2026Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injeCVE-2017-20261 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can supply crafted SQL statements in GET requests to the brainy and alice views to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 19, 2026Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting CVE-2017-20260 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the product_id parameter to extract sensitive database information including credentials and configuration data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgexploit-db.com
Jun 19, 2026Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries CVE-2017-20258 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_pofos&view=pofo&id=[SQL] to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextro.media
Jun 19, 2026Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the CVE-2017-20257 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the ajaxaction.flag_question task. Attackers can inject malicious SQL code via the stu_quiz_id or flag_quest parameters to manipulate database queries and extract sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomplace.comextensions.joomla.org
Jun 19, 2026Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciCVE-2017-20255 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the visatype parameter. Attackers can send GET requests to index.php with the option=com_bookpro and view=popup parameters, injecting SQL commands in the visatype parameter to extract sensitive database information including credentials and table contents.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoombooking.comextensions.joomla.org
Jun 19, 2026Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malCVE-2017-20254 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the userid parameter. Attackers can send GET requests to index.php with the option=com_userbench&view=detail&userid parameter containing SQL injection payloads to extract sensitive database information including credentials and configuration data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgegabyte.orgextensions.joomla.org
Jun 19, 2026Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maCVE-2017-20253 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgegabyte.orgextensions.joomla.org
May 26, 2026Lack of input filtering leads to an XSS vector in the HTML filter code.CVE-2026-48905 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of input filtering leads to an XSS vector in the HTML filter code.
- Product
- Joomla! Framework Filter package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allows privelege escalation through the com_users group editing webservice endpoint.CVE-2026-48904 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.2
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.CVE-2026-48903 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
- Product
- Joomla! Framework Filter package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.CVE-2026-48902 · Websites & servers · Joomla! Project · reported by security@joomla.orgCritical 9.8
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.CVE-2026-48901 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.CVE-2026-48900 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allows privilege escalation through the com_users batch task.CVE-2026-48899 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.3
An improper access check allows privilege escalation through the com_users batch task.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allows privilege escalation through the com_users batch task.CVE-2026-48898 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.2
An improper access check allows privilege escalation through the com_users batch task.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2026-48897 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.2
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2026-48896 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.2
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.CVE-2026-40384 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper validation of user-supplied input leads to a local file inclusion vulnerability.CVE-2026-40383 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allows unauthorized access to com_config webservice endpoints.CVE-2026-35223 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
An improper access check allows unauthorized access to com_config webservice endpoints.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.CVE-2026-35222 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.CVE-2026-35221 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.CVE-2026-35220 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 4.6
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of output escaping leads to a XSS vector in the readmore links for com_content.CVE-2026-30895 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of output escaping leads to a XSS vector in the content history component.CVE-2026-30894 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of output escaping leads to a XSS vector in the content history component.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-25901 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of output escaping leads to a XSS vector in the multilingual associations component.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of output escaping leads to a XSS vector in the feed modules.CVE-2026-25900 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of output escaping leads to a XSS vector in the feed modules.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2026Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inCVE-2018-25351 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the username parameter. Attackers can submit POST requests to the login endpoint with SQL injection payloads in the username field to extract database information including user credentials and system details.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgexploit-db.com
May 23, 2026Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL cCVE-2018-25348 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send GET requests to the user_detail view with malicious cid values containing SQL commands to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgexploit-db.com
May 17, 2026Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code throughCVE-2018-25330 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters. Attackers can inject script payloads in profile information fields like Address that execute when users visit the profile, or submit SQL injection payloads via the phone_no parameter to the user_setting endpoint to manipulate database queries.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgexploit-db.com
May 17, 2026Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validaCVE-2018-25327 · Websites & servers · reported by VulnCheckMedium 6.9
Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validation. Attackers can craft malicious HTML forms targeting administrative endpoints like job.jobenforcedelete to delete job entries or modify component settings when administrators visit attacker-controlled pages.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgexploit-db.com
Apr 1, 2026An improper access check allows unauthorized access to webservice endpoints.CVE-2026-23899 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
An improper access check allows unauthorized access to webservice endpoints.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.CVE-2026-23898 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of output escaping for article titles leads to XSS vectors in various locations.CVE-2026-21632 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping for article titles leads to XSS vectors in various locations.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-21631 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping leads to a XSS vector in the multilingual associations component.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orggithub.com
Apr 1, 2026Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.CVE-2026-21630 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026The ajax component was excluded from the default logged-in-user check in the administrative area.CVE-2026-21629 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.3
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Lack of output escaping leads to a XSS vector in the pagebreak plugin.CVE-2025-63083 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.CVE-2025-63082 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.CVE-2025-54477 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.3
Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.CVE-2025-54476 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 4.8
Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.