DeutschShown in its original language — a full translation is planned for a future version.
Joomla: Mehrere Schwachstellen
view advisory published 2026-05-26
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Joomla ausnutzen, um Angriffe wie Cross-Site Scripting (XSS), SQL-Injection, Privilegienerweiterung, Umgehung der Authentifizierung, Path Traversal, Local File Inclusion (LFI) und unbefugten Zugriff durchzuführen.
01
describes (20)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-48905US | medium6.1 | — | ||
Lack of input filtering leads to an XSS vector in the HTML filter code. | ||||
| CVE-2026-48904US | critical9.8 | — | ||
An improper access check allows privelege escalation through the com_users group editing webservice endpoint. | ||||
| CVE-2026-48903US | medium6.1 | — | ||
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components. | ||||
| CVE-2026-48902US | —OT elevated | — | ||
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. | ||||
| CVE-2026-48901US | — | — | ||
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key. | ||||
| CVE-2026-48900US | medium4.3 | — | ||
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks. | ||||
| CVE-2026-48899US | critical9.8 | — | ||
An improper access check allows privilege escalation through the com_users batch task. | ||||
| CVE-2026-48898US | critical9.8 | — | ||
An improper access check allows privilege escalation through the com_users batch task. | ||||
| CVE-2026-48897US | high7.5 | — | ||
Insufficient state checks lead to a vector that allows to bypass 2FA checks. | ||||
| CVE-2026-48896US | high7.5 | — | ||
Insufficient state checks lead to a vector that allows to bypass 2FA checks. | ||||
| CVE-2026-40384US | high7.5 | — | ||
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability. | ||||
| CVE-2026-40383US | critical9.8 | — | ||
An improper validation of user-supplied input leads to a local file inclusion vulnerability. | ||||
| CVE-2026-35223US | critical9.8 | — | ||
An improper access check allows unauthorized access to com_config webservice endpoints. | ||||
| CVE-2026-35222US | critical9.8 | — | ||
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. | ||||
| CVE-2026-35221US | critical9.8 | — | ||
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. | ||||
| CVE-2026-35220US | medium4.3 | — | ||
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users. | ||||
| CVE-2026-30895US | medium6.1 | — | ||
Lack of output escaping leads to a XSS vector in the readmore links for com_content. | ||||
| CVE-2026-30894US | medium6.1 | — | ||
Lack of output escaping leads to a XSS vector in the content history component. | ||||
| CVE-2026-25901US | medium6.1 | — | ||
Lack of output escaping leads to a XSS vector in the multilingual associations component. | ||||
| CVE-2026-25900US | medium6.1 | — | ||
Lack of output escaping leads to a XSS vector in the feed modules. | ||||
02
references
External citations — patches, advisories, analysis.
- Joomla Security Advisory 20260501 vom 2026-05-26external
- Joomla Security Advisory 20260502 vom 2026-05-26external
- Joomla Security Advisory 20260503 vom 2026-05-26external
- Joomla Security Advisory 20260504 vom 2026-05-26external
- Joomla Security Advisory 20260505 vom 2026-05-26external
- Joomla Security Advisory 20260506 vom 2026-05-26external
- Joomla Security Advisory 20260507 vom 2026-05-26external
- Joomla Security Advisory 20260508 vom 2026-05-26external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan