References https://www.exploit-db.com/exploits/43357 https://github.com/0xdsm/juumla/issues/1 https://www.globalsecuritymag.fr/Vigil-nce-Joomla-User-Bench-SQL,20180219,77024.html https://3dwebdesign.org/forum/joomla-vulnerable-extensions-list-t2298 https://github.com/noobteamcommunity/Pentests/blob/master/CMS/Joomla/joomscan/exploit/db/comvul.txt
Related VulnerabilitiesPoCCVE-2026-65761: Joomla Easy Store - SQL InjectionPoCCVE-2026-57827: RSFiles! for Joomla - Arbitrary File UploadPoCCVE-2026-48939: Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCELangflow /api/v1/custom_component 代码执行漏洞(CVE-2024-37014)PoCjoomla-com-fabrik-lfi: Joomla! com_fabrik 3.9.11 - Local File InclusionPoCCVE-2020-10532: WatchGuard Fireware AD Helper Component - Credentials DisclosurePoCCVE-2026-48907: Joomla! JCE extension < 2.9.99.5 unauthenticated RCEJoomla JCE /index.php com_jce 文件上传漏洞(CVE-2026-48907)PoCretool-postmessage-xss: Retool Self-Hosted - postMessage XSS via Custom Component CollectionsPoCCVE-2025-55184: React Server Components - Denial of ServicePoCjoomla-fpd: Joomla! - Full Path DisclosurePoCCVE-2025-55182: React Server Components - Remote Code Execution月子会所ERP管理云平台 /Page/upload/UploadComponentHandler.ashx 文件上传漏洞