Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,824

CVE-2022-23089

Out of bound read in elf_note_prpsinfo()

When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Freebsd
Products
Freebsd
CVE-2024-21728

Extension - smartcalc.es - Open redirect vulnerability in osTicky component for Joomla <= 2.2.8

An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky (osTicket Bridge) by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return parameter in the URL to a base64 malicious URL.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Smartcalc
Products
Osticky
CVE-2024-27184

[20240801] - Core - Inadequate validation of internal URLs

Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not..

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2024-27186

[20240803] - Core - XSS in HTML Mail Templates

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2024-27187

[20240804] - Core - Improper ACL for backend profile view

Improper Access Controls allows backend users to overwrite their username when disallowed.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2024-40743

[20240805] - Core - XSS vectors in Outputfilter::strip* methods

The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2024-40745

Extension - tassos.gr - Reflected Cross site scripting vulnerability in Convert Forms component for Joomla < 4.4.8

Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Convert Forms Project
Products
Convert Forms
CVE-2024-40747

[20250101] - Core - XSS vectors in module chromes

Various module chromes didn't properly process inputs, leading to XSS vectors.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2024-40748

[20250102] - Core - XSS vector in the id attribute of menu lists

Lack of output escaping in the id attribute of menu lists.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2024-40749

[20250103] - Core - Read ACL violation in multiple core views

Improper Access Controls allows access to protected views.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2025-22204

Extension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for Joomla

Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Regularlabs
Products
Sourcerer
CVE-2025-22205

Extension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomla

Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Admiror-design-studio
Products
Admiror Gallery
CVE-2025-22206

Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.

CVSS 3.1 · 4.7 Medium EPSS 9.2% KEV · Not listed
Vendors
Joomsky
Products
Js Jobs
CVE-2025-22208

Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Joomsky
Products
Js Jobs
CVE-2025-22209

Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Joomsky
Products
Js Jobs
CVE-2025-22210

Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla

A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Hikashop
Products
Hikashop
CVE-2025-25226

[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!
CVE-2025-25227

[20250402] - Joomla Core - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla\!