Joomla: >> Joomla! Security Vulnerabilities
Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs.
CVSS Score
5.1
EPSS Score
0.003
Published
2026-08-18
Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.
CVSS Score
5.1
EPSS Score
0.003
Published
2026-08-18
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.
CVSS Score
8.9
EPSS Score
0.006
Published
2026-08-18
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.
CVSS Score
8.5
EPSS Score
0.003
Published
2026-08-18
Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.
CVSS Score
5.1
EPSS Score
0.003
Published
2026-08-18
Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.
CVSS Score
8.2
EPSS Score
0.005
Published
2026-08-18
Improper validation leads to a generic XSS vector in the language override feature.
CVSS Score
5.9
EPSS Score
0.002
Published
2026-07-07
An improper access check allows unauthorized users to access workflow stage and transition information.
CVSS Score
6.4
EPSS Score
0.003
Published
2026-07-07
An improper access check allows users to display a list of modules in the frontend.
CVSS Score
6.4
EPSS Score
0.003
Published
2026-07-07
An improper access check allows unauthorized users to access com_privacy datasets.
CVSS Score
6.4
EPSS Score
0.004
Published
2026-07-07