According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 5.4.6, or 6.x prior to 6.1.1. It is, therefore, affected by multiple vulnerabilities.

- An XSS in feed modules due to lack of output escaping. (CVE-2026-25900)

- An XSS in the multilingual associations component (com_associations). (CVE-2026-25901)

- An XSS in the content history component (com_contenthistory). (CVE-2026-30894)

- An XSS in readmore links. (CVE-2026-30895)

- A CSRF in the admin user activation endpoint of com_users (6.x only). (CVE-2026-35220)

- An authenticated blind SQL injection in the com_finder search query. (CVE-2026-35221)

- An authenticated blind SQL injection in com_tags due to improperly validated order clauses. (CVE-2026-35222)

- An improper access check in com_config webservice endpoints. (CVE-2026-35223)

- A local file inclusion (LFI) in the HTMLView layout parameter due to improper input validation. (CVE-2026-40383)

- A path traversal in the com_media webservice endpoint search parameter. (CVE-2026-40384)

- An MFA authentication bypass via insufficient state checks. (CVE-2026-48896)

- An MFA authentication bypass via incorrectly reset session states. (CVE-2026-48897)

- A privilege escalation through the com_users batch task. (CVE-2026-48898)

- A privilege escalation through the com_users group editing webservice endpoint. (CVE-2026-48904)

- An incorrect access control in sample data plugins. (CVE-2026-48899)

- An incorrect access control in com_scheduler allowing low-privileged users to modify task types. (CVE-2026-48900)

- An incorrect cache key construction for InputFilter objects. (CVE-2026-48901)

- A transport encryption downgrade for password and username reset links on HTTPS sites. (CVE-2026-48902)

- Inadequate content filtering in the framework checkAttribute filter leading to XSS. (CVE-2026-48903)

- Inadequate content filtering in the framework cleanAttributes filter leading to XSS. (CVE-2026-48905)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115256	Joomla! 3.x < 5.4.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	5/28/2026	5/28/2026	high
115257	Joomla! 6.x < 6.1.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	5/28/2026	5/28/2026	high

Detections

Analytics

Plugins Search

high

high