Skip to content

Joomla · weakness class

SQL Injection

123 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

check available
2
likely to be exploited
4

Every one of the 123 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Joomla! Core SQL InjectionCVE-2015-7297Joomla · 100% likely

    CWE-89

  2. Joomla! <3.7.1 - SQL InjectionCVE-2017-8917Joomla · 100% likely

    CWE-89

  3. SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to e…CVE-2015-7857Joomla · 94% likely

    CWE-89

  4. SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-…CVE-2015-7858Joomla · 86% likely

    CWE-89

  5. [20201104] - Core - SQL injection in com_users list viewCVE-2020-35613Joomla! Project · 29% likely

    CWE-89

  6. In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view.CVE-2018-8045Joomla · 28% likely

    CWE-89

  7. SQL injection vulnerability in index.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid pa…CVE-2008-0690Joomla · 9.0% likely

    CWE-89

  8. SQL injection vulnerability in Joomla! CMS 3.1.x and 3.2.x before 3.2.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2014-7981Joomla · 8.5% likely

    CWE-89

  9. In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.CVE-2018-6376Joomla · 4.1% likely

    CWE-89

  10. SQL injection vulnerability in the DT Register (com_dtregister) 2.2.3 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the eventId parameter in…CVE-2008-3265Joomla · 3.0% likely

    CWE-89

  11. SQL injection vulnerability in index.php in the MediaSlide (com_mediaslide) 0.5 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the albumnum pa…CVE-2008-0802Joomla · 2.1% likely

    CWE-89

  12. SQL injection vulnerability in index.php in the RSGallery (com_rsgallery) 2.0 beta 5 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL c…CVE-2007-6362Joomla · 2.1% likely

    CWE-89

  13. SQL injection vulnerability in the IDoBlog (com_idoblog) component b24 and earlier and 1.0, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via…CVE-2008-2627Joomla · 2.1% likely

    CWE-89

  14. SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.p…CVE-2009-0421Joomla · 2.0% likely

    CWE-89

  15. SQL injection vulnerability in sub_votepic.php in the Datsogallery (com_datsogallery) module 1.6 for Joomla! allows remote attackers to execute arbitrary SQL commands via the User…CVE-2008-5208Joomla · 2.0% likely

    CWE-89

  16. SQL injection vulnerability in the Ignite Gallery (com_ignitegallery) component 0.8.0 through 0.8.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the g…CVE-2008-6182Joomla · 2.0% likely

    CWE-89

  17. Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.CVE-2011-1151Joomla! · 1.9% likely

    CWE-89

  18. An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles fronten…CVE-2020-10243Joomla · 1.8% likely

    CWE-89

  19. SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the article parameter in index.php. N…CVE-2009-1499Joomla · 1.8% likely

    CWE-89

  20. In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.CVE-2019-19846Joomla · 1.7% likely

    CWE-89

  21. SQL injection vulnerability in the GameQ (com_gameq) component 4.0 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter…CVE-2008-2701Joomla · 1.6% likely

    CWE-89

  22. SQL injection vulnerability in Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to the arch…CVE-2007-4777Joomla · 1.4% likely

    CWE-89

  23. Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via (1) the filter_order parameter in a com_weblinks…CVE-2010-4166Joomla · 1.4% likely

    CWE-89

  24. SQL injection vulnerability in the CamelcityDB (com_camelcitydb2) component 2.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index…CVE-2010-4945Joomla · 1.3% likely

    CWE-89

  25. Multiple SQL injection vulnerabilities in the content component (com_content) in Joomla! 1.5 Beta1, Beta2, and RC1 allow remote attackers to execute arbitrary SQL commands via the…CVE-2007-4778Joomla · 1.3% likely

    CWE-89

  26. SQL injection vulnerability in the EQ Event Calendar component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to eqfullevent.CVE-2015-4654Joomla · 1.3% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.