Средняя
CVSS 5.9
CVE-2026-48954
Разработчикjoomla
Improper validation leads to a generic XSS vector in the language override feature.
База уязвимостей Joomla
CVE Joomla.
Устраните уязвимости до заражения сайта.
Проверяйте риски раньше, чем они станут инцидентом. Поиск по ядру Joomla и популярным расширениям, оценка CVSS и прямые ссылки на первичные источники.
Динамика уязвимостей
Обновляется
1 419
уязвимостей в общем периоде
170за 3 месяца
85за месяц
57за неделю
Часто встречаются:
JCESP Page BuilderHelix UltimateBalbooa FormsEvents BookingDJ-ClassifiedsRSFiles!Phoca Download
Данные обновлены 24.07.2026 · по Москве
Каталог
Все известные уязвимости
Статус «активна» означает, что запись опубликована в 2026 году. Он не заменяет проверку версии и официального исправления.
Средняя
CVSS 5.9
CVE-2026-48949
Разработчикjoomla
Lack of validation leads to an XSS vulnerability in the MFA management views.
Средняя
CVSS 5.9
CVE-2026-48950
Разработчикjoomla
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
Средняя
CVSS 5.9
CVE-2026-48951
Разработчикjoomla
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
Средняя
CVSS 5.9
CVE-2026-48952
Разработчикjoomla
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
Средняя
CVSS 5.9
CVE-2026-48953
Разработчикjoomla
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
Средняя
CVSS 6.4
CVE-2026-48947
Разработчикjoomla
An improper access check allows privileged users to overwrite media files without editing permissions.
Средняя
CVSS 6.4
CVE-2026-48948
Разработчикjoomla
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
Критическая
CVSS 10.0
CVE-2026-56290
РасширениеJoomlack Page Builder Ck
Разработчикjoomlack.fr
Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading execu…
Высокая
CVSS 7.5
CVE-2026-49049
РасширениеHelix3
РазработчикJoomShaper
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.
Высокая
CVSS 8.7
CVE-2026-49048
РасширениеJoomcoder Joomcck
Разработчикjoomcoder
The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without es…
Средняя
CVSS 6.5
CVE-2026-48943
РасширениеJoomlaworks K2
Разработчикgetk2
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.sa…
Низкая
CVSS 3.4
CVE-2026-48940
РасширениеJoomlaworks K2
Разработчикgetk2
A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it u…
Критическая
CVSS 10.0
CVE-2026-48939
РасширениеJoomlic Icagenda
Разработчикicagenda
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Критическая
CVSS 10.0
CVE-2026-48908
РасширениеSP Page Builder
РазработчикJoomShaper
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Высокая
CVSS 8.7
CVE-2023-54357
Разработчикartio
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function i…
Высокая
CVSS 8.7
CVE-2019-25762
Разработчикjoomboost
Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoin…
Высокая
CVSS 7.1
CVE-2019-25761
Разработчикjoomboost
Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal_id…