Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- Critical10.0Joomlack Page Builder Improper Access Control VulnerabilityKEVEPSS 30.9%Jun 27, 2026
- Critical10.0Widget Factory Joomla Content Editor Improper Access Control VulnerabilityKEVEPSS 16.2%Jun 5, 2026
- High8.8Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation.Jun 3, 2026
- High7.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection.Jun 3, 2026
- High8.8Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting malici…Jun 1, 2026
- Medium6.9Lack of input filtering leads to an XSS vector in the HTML filter code.EPSS 0.2%May 26, 2026
- High8.2An improper access check allows privelege escalation through the com_users group editing webservice endpoint.EPSS 0.5%May 26, 2026
- Medium6.9Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.EPSS 0.2%May 26, 2026
- Critical9.8The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.EPSS 0.3%May 26, 2026
- High7.5The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.EPSS 0.4%May 26, 2026
- Medium6.4An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.EPSS 0.3%May 26, 2026
- Medium5.3An improper access check allows privilege escalation through the com_users batch task.EPSS 0.4%May 26, 2026
- High8.2An improper access check allows privilege escalation through the com_users batch task.EPSS 0.5%May 26, 2026
- High8.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.EPSS 0.4%May 26, 2026
- High8.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.EPSS 0.4%May 26, 2026
- Medium5.9An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.EPSS 0.5%May 26, 2026
- High7.5An improper validation of user-supplied input leads to a local file inclusion vulnerability.EPSS 0.6%May 26, 2026
- High8.6An improper access check allows unauthorized access to com_config webservice endpoints.EPSS 0.5%May 26, 2026
- Medium6.9Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.EPSS 0.5%May 26, 2026
- Medium6.9Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.EPSS 0.5%May 26, 2026
- Medium4.6Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.EPSS 0.1%May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the readmore links for com_content.EPSS 0.2%May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the content history component.EPSS 0.2%May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the multilingual associations component.EPSS 0.2%May 26, 2026
- Medium6.9Lack of output escaping leads to a XSS vector in the feed modules.EPSS 0.2%May 26, 2026