Joomla: community verdicts
2 notable / known-exploited Joomla CVEs the community has triaged.
ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Joomla CVE, see NVD ↗.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2016 | 1 | 1 |
| 2017 | 0 | 0 |
| 2018 | 0 | 0 |
| 2019 | 0 | 0 |
| 2020 | 0 | 0 |
| 2021 | 0 | 0 |
| 2022 | 0 | 0 |
| 2023 | 1 | 1 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2016-10033CRIT 9.8KEVEPSS 100%
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
- CVE-2023-23752MED 5.3KEVEPSS 100%
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.