DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Joomla: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-09-29
Ein Angreifer kann mehrere Schwachstellen in Joomla ausnutzen um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, sensible Daten offenzulegen oder zu manipulieren und seine Berechtigungen zu erweitern.
01
beschreibt (16)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-92232US | medium6.5 | — | ||
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method remov… | ||||
| CVE-2026-92231US | medium6.7 | — | ||
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an at… | ||||
| CVE-2026-92227US | high7.5 | — | ||
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to… | ||||
| CVE-2026-92226US | medium6.0 | — | ||
Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to p… | ||||
| CVE-2026-92225US | medium6.7 | — | ||
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS ve… | ||||
| CVE-2026-92224US | medium6.7 | — | ||
Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector. | ||||
| CVE-2026-92223US | low3.8 | — | ||
Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update… | ||||
| CVE-2026-92222US | high8.0 | — | ||
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading… | ||||
| CVE-2026-90918US | medium5.3 | — | ||
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in mul… | ||||
| CVE-2026-90917US | medium5.3 | — | ||
Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view c… | ||||
| CVE-2026-90916US | low2.7 | — | ||
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to… | ||||
| CVE-2026-90915US | medium6.5 | — | ||
Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed pa… | ||||
| CVE-2026-90914US | medium6.4 | — | ||
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio… | ||||
| CVE-2026-90913US | medium5.5 | — | ||
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users… | ||||
| CVE-2026-90907US | medium5.3 | Exploit | ||
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the… | ||||
| CVE-2026-90906US | high8.3 | — | ||
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Joomla Security Centre vom 2026-09-29external
- Joomla Security Advisory 20260901 - Core - XSS in HTMLHelper::link method vom 2026-09-29external
- Joomla Security Advisory 20260902 - Core - Unauthorized user account creation via profile.save controller vom 2026-09-29external
- Joomla Security Advisory 20260903 - Core - Improper ACL checks for access level webservice endpoints vom 2026-09-29external
- Joomla Security Advisory 20260904 - Core - XSS in the generic media output layouts vom 2026-09-29external
- Joomla Security Advisory 20260905 - Core - Arbitrary directory deletion via cache purge action vom 2026-09-29external
- Joomla Security Advisory 20260906 - Core - Improper ACL checks in content history comparison view vom 2026-09-29external
- Joomla Security Advisory 20260907 - Core - Improper ACL checks in outputs for tagged items vom 2026-09-29external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan