Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,686 results · page 9 of 34
May 17, 2026Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code throughCVE-2018-25330 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters. Attackers can inject script payloads in profile information fields like Address that execute when users visit the profile, or submit SQL injection payloads via the phone_no parameter to the user_setting endpoint to manipulate database queries.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgexploit-db.com
May 17, 2026Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validaCVE-2018-25327 · Websites & servers · reported by VulnCheckMedium 6.9
Joomla! Component Js Jobs 1.2.0 contains a cross-site request forgery vulnerability that allows attackers to perform state-changing actions without token validation. Attackers can craft malicious HTML forms targeting administrative endpoints like job.jobenforcedelete to delete job entries or modify component settings when administrators visit attacker-controlled pages.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgexploit-db.com
May 13, 2026Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL cCVE-2020-37226 · Websites & servers · reported by VulnCheckHigh 7.1
Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'sortby' parameter. Attackers can send POST requests to the administrator index with malicious 'sortby' values to extract sensitive database information using automated tools.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomsky.comjoomsky.com
May 13, 2026Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL cCVE-2020-37224 · Websites & servers · reported by VulnCheckHigh 7.1
Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'sortby' parameter. Attackers can send POST requests to the administrator index with malicious 'sortby' values to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomsky.comjoomsky.com
May 13, 2026Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder pCVE-2020-37219 · Websites & servers · reported by VulnCheckHigh 8.7
Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter. Attackers can send GET requests to the onAjax_files method with path traversal sequences to enumerate files in system directories outside the intended web root.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfabrikar.comfabrikar.com
May 13, 2026Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries bCVE-2020-37218 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hdwplayersearch parameter. Attackers can submit POST requests with crafted SQL payloads in the hdwplayersearch parameter to extract sensitive database information from the hdwplayer_videos table.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comhdwplayer.com
May 10, 2026Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to executCVE-2021-47930 · Websites & servers · reported by VulnCheckHigh 8.8
Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbitrary SQL queries. Attackers can send POST requests to the com_baforms component with malicious JSON payloads in the 'id' field parameter to extract sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbalbooa.comexploit-db.com
Apr 11, 2026Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.CVE-2026-23900 · Other software · phoca.cz · reported by security@joomla.orgMedium 6.5
Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.
- Product
- phoca.cz - Phoca Maps for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that alloCVE-2026-34424 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trigger pre-authentication remote shell execution via HTTP headers, establish authenticated backdoors accepting arbitrary PHP code or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must-use plugins and core file modifications.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordmysites.gurupatchstack.com
Apr 9, 2026Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating CVE-2023-54364 · Websites & servers · reported by VulnCheckMedium 5.1
Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddemo.hikashop.comexploit-db.com
Apr 9, 2026Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulatingCVE-2023-54363 · Websites & servers · reported by VulnCheckMedium 5.1
Joomla Solidres 2.13.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating multiple GET parameters including show, reviews, type_id, distance, facilities, categories, prices, location, and Itemid. Attackers can craft malicious URLs containing JavaScript payloads in these parameters to steal session tokens, login credentials, or manipulate site content when victims visit the crafted links.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolidres.comextensions.joomla.org
Apr 9, 2026Joomla VirtueMart Shopping-Cart 4.0.12 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulatingCVE-2023-54362 · Websites & servers · reported by VulnCheckMedium 5.1
Joomla VirtueMart Shopping-Cart 4.0.12 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the keyword parameter. Attackers can craft malicious URLs containing script payloads in the keyword parameter of the product-variants endpoint to execute arbitrary JavaScript in victim browsers and steal session tokens or credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddemo.virtuemart.netexploit-db.com
Apr 9, 2026Joomla iProperty Real Estate 4.1.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating theCVE-2023-54361 · Websites & servers · reported by VulnCheckMedium 5.1
Joomla iProperty Real Estate 4.1.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the filter_keyword parameter. Attackers can craft URLs containing JavaScript payloads in the filter_keyword GET parameter of the all-properties-with-map endpoint to execute arbitrary code in victim browsers and steal session tokens or credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthethinkery.netextensions.joomla.org
Apr 9, 2026Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the review_idCVE-2023-54360 · Websites & servers · reported by VulnCheckMedium 5.1
Joomla JLex Review 6.0.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the review_id URL parameter. Attackers can craft malicious links containing JavaScript payloads that execute in victims' browsers when clicked, enabling session hijacking or credential theft.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgjlexart.com
Apr 1, 2026An improper access check allows unauthorized access to webservice endpoints.CVE-2026-23899 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
An improper access check allows unauthorized access to webservice endpoints.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.CVE-2026-23898 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of output escaping for article titles leads to XSS vectors in various locations.CVE-2026-21632 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping for article titles leads to XSS vectors in various locations.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-21631 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping leads to a XSS vector in the multilingual associations component.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orggithub.com
Apr 1, 2026Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.CVE-2026-21630 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026The ajax component was excluded from the default logged-in-user check in the administrative area.CVE-2026-21629 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.3
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point.CVE-2026-21627 · Websites & servers · reported by security@joomla.orgCritical 9.5
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosureCVE-2026-21626 · Other software · Stackideas.com · reported by security@joomla.orgCritical 9.2
Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure
- Product
- EasyDiscuss extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026User provided uploads to the Easy Discuss component for Joomla aren't properly validated.CVE-2026-21625 · Websites & servers · reported by security@joomla.orgMedium 4.8
User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.CVE-2026-21624 · Websites & servers · reported by security@joomla.orgCritical 9.4
Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.CVE-2026-21623 · Websites & servers · reported by security@joomla.orgCritical 9.4
Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Lack of output escaping leads to a XSS vector in the pagebreak plugin.CVE-2025-63083 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.CVE-2025-63082 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.CVE-2025-55758 · Websites & servers · reported by security@joomla.orgMedium 5.4
Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2025A unauthenticated reflected XSS vulnerability in VirtueMart 1.0.0-4.4.10 for Joomla was discovered.CVE-2025-55757 · Websites & servers · reported by security@joomla.orgMedium 6.1
A unauthenticated reflected XSS vulnerability in VirtueMart 1.0.0-4.4.10 for Joomla was discovered.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvirtuemart.net
Oct 3, 2025SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3.CVE-2025-40636 · Websites & servers · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisitcounter’ cookie at all endpoints where the plugin counts visits.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.CVE-2025-54477 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.3
Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.CVE-2025-54476 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 4.8
Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered.CVE-2025-54301 · Other software · norrnext.com · reported by security@joomla.orgHigh 8.5
A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped.
- Product
- Quantum Mamanger component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered.CVE-2025-54300 · Other software · norrnext.com · reported by security@joomla.orgHigh 8.5
A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads.
- Product
- Quantum Mamanger component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands.CVE-2025-54475 · Other software · joomsky.com · reported by security@joomla.orgHigh 8.7
A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commands.
- Product
- JS Jobs component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered.CVE-2025-54474 · Other software · dj-extensions.com · reported by security@joomla.orgHigh 8.5
A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands.
- Product
- DJ-Classifieds component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered.CVE-2025-54473 · Other software · phoca.cz · reported by security@joomla.orgCritical 9.2
An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature.
- Product
- phoca.cz - Phoca Commander for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.CVE-2025-54299 · Other software · nobossextensions.com · reported by security@joomla.orgCritical 9.4
A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.
- Product
- No Boss Testimonials component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.CVE-2025-54298 · Other software · firecoders.com · reported by security@joomla.orgCritical 9.4
A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.
- Product
- CommentBox component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered.CVE-2025-54297 · Other software · compojoom.com · reported by security@joomla.orgHigh 7
A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered.
- Product
- CComment component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered.CVE-2025-54296 · Other software · mooj.org · reported by security@joomla.orgHigh 7
A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered.
- Product
- ProFiles component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.CVE-2025-54295 · Other software · dj-extensions.com · reported by security@joomla.orgMedium 5.1
A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.
- Product
- DJ-Reviews component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered.CVE-2025-54294 · Other software · stackideas.com · reported by security@joomla.orgCritical 9.3
A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered. The issue allows unprivileged users to execute arbitrary SQL commands.
- Product
- Komento component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered.CVE-2025-50127 · Other software · dj-extensions.com · reported by security@joomla.orgHigh 8.5
A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands.
- Product
- DJ-Flyer component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered.CVE-2025-50126 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 5.3
A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web script or HTML via the jform[tags_text] parameter.
- Product
- RSBlog! component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A stored XSS vulnerability in the RSDirectory! component 1.0.0-2.2.8 Joomla was discovered.CVE-2025-50058 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 5.1
A stored XSS vulnerability in the RSDirectory! component 1.0.0-2.2.8 Joomla was discovered. The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the review reply component.
- Product
- RSDirectory! component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A DOS vulnerability in RSFiles! component 1.16.3-1.17.7 Joomla was discovered.CVE-2025-50057 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 6.9
A DOS vulnerability in RSFiles! component 1.16.3-1.17.7 Joomla was discovered. The issue allows unauthenticated remote attackers to deny access to service via the search feature.
- Product
- RSFiles! component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A reflected XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 28 Joomla was discovered.CVE-2025-50056 · Other software · rsjoomla.com · reported by security@joomla.orgMedium 5.1
A reflected XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 28 Joomla was discovered. The issue allows remote attackers to inject arbitrary web script or HTML via the crafted parameter.
- Product
- RSMail! component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items.CVE-2025-49486 · Other software · balbooa.com · reported by security@joomla.orgHigh 8.6
A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items.
- Product
- Balbooa Gallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameCVE-2025-49485 · Other software · balbooa.com · reported by security@joomla.orgHigh 8.6
A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter.
- Product
- Balbooa Forms component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.