According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 5.4.7, or 6.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities.

- An improper access check allows privileged users to overwrite media files without editing permissions in com_media webservice endpoints. (CVE-2026-48947)

- An incorrect access control vulnerability exists in the com_contact vcf download component. (CVE-2026-48948)

- A cross-site scripting (XSS) vulnerability exists in MFA method management. (CVE-2026-48949)

- A cross-site scripting (XSS) vulnerability exists in com_templates. (CVE-2026-48950)

- A cross-site scripting (XSS) vulnerability exists in various modalreturn layouts. (CVE-2026-48951)

- A cross-site scripting (XSS) vulnerability exists in com_installer. (CVE-2026-48952)

- A cross-site scripting (XSS) vulnerability exists in the generic image output layout. (CVE-2026-48953)

- A cross-site scripting (XSS) vulnerability exists through language overrides. (CVE-2026-48954)

- An incorrect access control vulnerability exists in com_workflow. (CVE-2026-48955)

- An incorrect access control vulnerability exists in com_modules. (CVE-2026-48956)

- An incorrect access control vulnerability exists in com_privacy webservice endpoints. (CVE-2026-48957)

- An incorrect access control vulnerability exists in com_fields webservice endpoints. (CVE-2026-48958)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 5.4.7 or 6.0.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities.

  - An improper access check allows unauthorized users to create custom fields via webservices endpoints.
    (CVE-2026-48958)

  - An improper access check allows privileged users to overwrite media files without editing permissions.
    (CVE-2026-48947)

  - An improper access check allows user to download vcard exports of com_contact contacts that are     inaccessible. (CVE-2026-48948)

  - Lack of validation leads to an XSS vulnerability in the MFA management views. (CVE-2026-48949)

  - Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
    (CVE-2026-48950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115294	Joomla! 6.x < 6.1.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/13/2026	7/13/2026	high
115293	Joomla! 5.x < 5.4.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/13/2026	7/13/2026	high
325458	Joomla 3.0.x < 5.4.7 / 6.0.x < 6.1.2 Multiple Vulnerabilities (joomla-6-1-2-5-4-7-security-bugfix-release)	Nessus	CGI abuses	7/7/2026	10/8/2026	high

Detections

Analytics

Plugins Search

high

high

high