Высокая
CVSS 8.2
CVE-2026-48898
Разработчикjoomla
An improper access check allows privilege escalation through the com_users batch task.
Каталог CVE
Разработчик: joomla
Каталог
Все известные уязвимости
Статус «активна» означает, что запись опубликована в 2026 году. Он не заменяет проверку версии и официального исправления.
Критическая
CVSS 9.8
CVE-2026-48902
Разработчикjoomla
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
Высокая
CVSS 7.5
CVE-2026-48901
Разработчикjoomla
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
Высокая
CVSS 8.2
CVE-2026-48897
Разработчикjoomla
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
Высокая
CVSS 8.2
CVE-2026-48896
Разработчикjoomla
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
Средняя
CVSS 5.9
CVE-2026-40384
Разработчикjoomla
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
Высокая
CVSS 7.5
CVE-2026-40383
Разработчикjoomla
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
Высокая
CVSS 8.6
CVE-2026-35223
Разработчикjoomla
An improper access check allows unauthorized access to com_config webservice endpoints.
Средняя
CVSS 6.9
CVE-2026-35222
Разработчикjoomla
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
Средняя
CVSS 6.9
CVE-2026-35221
Разработчикjoomla
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
Средняя
CVSS 4.6
CVE-2026-35220
Разработчикjoomla
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
Средняя
CVSS 6.9
CVE-2026-30895
Разработчикjoomla
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
Средняя
CVSS 6.9
CVE-2026-30894
Разработчикjoomla
Lack of output escaping leads to a XSS vector in the content history component.
Средняя
CVSS 6.9
CVE-2026-25901
Разработчикjoomla
Lack of output escaping leads to a XSS vector in the multilingual associations component.
Средняя
CVSS 6.9
CVE-2026-25900
Разработчикjoomla
Lack of output escaping leads to a XSS vector in the feed modules.
Критическая
CVSS 9.8
CVE-2017-16634
РасширениеJoomla Joomla\!
Разработчикjoomla
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.
Средняя
CVSS 4.3
CVE-2017-16633
РасширениеJoomla Joomla\!
Разработчикjoomla
In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.
Критическая
CVSS 9.8
CVE-2017-14596
РасширениеJoomla Joomla\!
Разработчикjoomla
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.