{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Joomla! vulnerabilities","home_page_url":"https://patchfirst.co/vendor/joomla/","feed_url":"https://patchfirst.co/feed/vendor/joomla.json","description":"New and newly exploited Joomla! CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-23752#kev","url":"https://patchfirst.co/cve/CVE-2023-23752/","title":"[KEV] CVE-2023-23752: Joomla! Improper Access Control Vulnerability","content_text":"Joomla! · Joomla!. In CISA KEV since 2024-01-08. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 66.7 of 100.","summary":"Joomla! Improper Access Control Vulnerability","date_published":"2024-01-08T00:00:00.000Z","date_modified":"2026-06-17T05:37:50.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":66.7,"kev":{"dateAdded":"2024-01-08","ransomware":false},"epss":{"score":0.99809,"percentile":0.99958},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Joomla!","product":"Joomla!","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2011-4908","url":"https://patchfirst.co/cve/CVE-2011-4908/","title":"CVE-2011-4908: TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php","content_text":"Joomla! · TinyBrowser Plugin. Not in CISA KEV. EPSS 55.8% (higher than 99.04% of CVEs). Public exploit code exists. Priority 24.8 of 100.","summary":"TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php","date_published":"2020-02-12T00:00:00.000Z","date_modified":"2024-08-07T00:23:38.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":24.8,"kev":null,"epss":{"score":0.55769,"percentile":0.99041},"cvss":null,"vendor":"Joomla!","product":"TinyBrowser Plugin","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}