# Joomla Joomla\!


- [CVE-2016-10033](https://insights.sbomify.com/CVE-2016-10033/): PHPMailer Command Injection (critical 9.8, exploited in the wild)
- [CVE-2023-23752](https://insights.sbomify.com/CVE-2023-23752/): Joomla! Improper Access Control (medium 5.3, exploited in the wild)
- [CVE-2026-48902](https://insights.sbomify.com/CVE-2026-48902/): Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links (critical 9.8)
- [CVE-2025-25226](https://insights.sbomify.com/CVE-2025-25226/): [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package (critical 9.8)
- [CVE-2022-23795](https://insights.sbomify.com/CVE-2022-23795/): [20220303] - Core - User row are not bound to a authentication mechanism (critical 9.8)
- [CVE-2022-23797](https://insights.sbomify.com/CVE-2022-23797/): [20220305] - Core - Inadequate filtering on the selected Ids (critical 9.8)
- [CVE-2022-23799](https://insights.sbomify.com/CVE-2022-23799/): [20220307] - Core - Variable Tampering on JInput $_REQUEST data (critical 9.8)
- [CVE-2010-1433](https://insights.sbomify.com/CVE-2010-1433/): File upload in Joomla (critical 9.8)
- [CVE-2010-1435](https://insights.sbomify.com/CVE-2010-1435/): Missing authorization in Joomla (critical 9.8)
- [CVE-2020-35613](https://insights.sbomify.com/CVE-2020-35613/): [20201104] - Core - SQL injection in com_users list view (critical 9.8)
- [CVE-2020-10243](https://insights.sbomify.com/CVE-2020-10243/): SQL injection in n/a (critical 9.8)
- [CVE-2019-19846](https://insights.sbomify.com/CVE-2019-19846/): SQL injection in n/a (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/joomla/joomla%5C/