According to its self-reported version number, the version of Joomla! installed on the remote host is prior to 5.4.8 / 6.1.3. It is, therefore, affected by multiple vulnerabilities:

 - Lack of output processing allows a response header injection in the multiple download views, leading to reflected file download / content-type confusion. (CVE-2026-71572)

 - An improper implementation prevents configured CORS origins from being properly validated in CORS requests. (CVE-2026-71573)

 - Improper access validation permits unauthorized users to execute mutation operations through webservice endpoints. (CVE-2026-71574)

 - An improper access check allows unauthorized users to create fields for inaccessible components via the custom fields webservice endpoints. (CVE-2026-72531)

 - An improper access check allows unauthorized users to create categories for inaccessible components via the category webservice endpoints. (CVE-2026-72532)

 - Improper escaping flags create a cross-site scripting (XSS) vulnerability through schema.org outputs. (CVE-2026-73336)

 - Insufficient state checks lead to a vector that allows bypassing multi-factor authentication (MFA) checks. (CVE-2026-73337)

 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items. (CVE-2026-73371)

 - An improper access check injects contact information for inaccessible contact items into schema.org snippets. (CVE-2026-73372)

 - The default list of dangerous file types does not include SHTML files, potentially allowing unrestricted uploads that could execute as code on servers configured to process them. (CVE-2026-73373)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.0.x prior to 5.4.8 or 6.0.x prior to 6.1.3. It is, therefore, affected by a vulnerability.

  - Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The     default list of dangerous files did not include SHTML files. On servers that executed these files, that     could lead to code execution. (CVE-2026-73373)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115460	Joomla! 6.x < 6.1.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/1/2026	9/1/2026	high
115459	Joomla! 5.x < 5.4.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	9/1/2026	9/1/2026	high
337679	Joomla 1.0.x < 5.4.8 / 6.0.x < 6.1.3 Joomla 6.1.3 & 5.4.8 Security & Bugfix Release (joomla-6-1-3-5-4-8-security-bugfix-release)	Nessus	CGI abuses	8/18/2026	9/7/2026	high

Detections

Analytics

Plugins Search

high

high

high