joomla.org

Results Summary

30 findings detected across joomla.org.

5 components identified. WordPress detected: No.

Severity Breakdown

Total findings detected across all components. The public summary below groups findings by vulnerability type. To see every affected component in full detail, run a free scan on your own domain at vulnify.app/tools.

Findings Overview

30 unique issues shown below, grouped from 30 total findings. When a vulnerability affects multiple components, it is listed once with the affected component count.

• high Multiple high-value Joomla public surfaces responded during validation

  Observed 4 high-value Joomla surfaces responding across API, administrator, installation, and manifest endpoints. That creates a much richer reconnaissance picture than a homepage-only scan would show.

• medium [REDACTED]: missing

  Restricts Adobe Flash and PDF policies

• medium CSP missing object-src restriction

  Object/embed content is not explicitly restricted.

• medium CSP missing frame-ancestors

  Clickjacking protection may be incomplete without frame-ancestors.

• medium CSP contains 'unsafe-inline'

  Inline script execution weakens CSP effectiveness.

• medium CSP contains wildcard source

  Wildcard sources can over-broaden execution or data exfiltration paths.

• medium Cookie missing SameSite attribute

  [REDACTED]: [REDACTED]=[REDACTED]; path=/; secure; HttpOnly

• medium Potentially sensitive paths are accessible

  /administrator/ (200, reachable-artifact, confidence:medium)

• medium Disclosure headers or generator metadata expose stack details

  Generator: Joomla! - Open Source Content Management, Server: cloudflare

• medium Technology fingerprint signals were detected across the public surface

  Generator Meta on /, /about-joomla.html, /core-features.html, /about-joomla/the-project.html, /contribute-to-joomla.html | Joomla on /, /about-joomla.html, /core-features.html, /about-joomla/the-project.html, /contribute-to-joomla.html | Bootstrap on…

• low Joomla extension and template footprint detected

  Detected 5 Joomla core, component, module, plugin, or template signal(s) from public assets and sampled routes.

• low Version-confirmed Joomla component evidence was collected

  Confirmed version clues for 1 Joomla component signal(s) from public assets, generator hints, or manifest data. This is stronger than component-only visibility because it helps drive patch decisions immediately.

• low Joomla core version clue was exposed publicly

  Observed Joomla version evidence: 180x180.png. Public core-version clues can accelerate exploit-path selection for attackers tracking Joomla advisories.

• low Public Joomla API surface responded during validation

  Observed /api/index.php/v1 responding with status 403. Review whether this public API exposure is intentional and aligned with your access design.

• low Joomla administrator entry point is publicly reachable

  Observed /administrator/ responding with status 200. Public reachability is common, but high-value admin paths should still be protected by stronger controls and monitoring.

• info Joomla footprint signals detected

  Joomla signal count: 4 | core version clue: 180x180.png. Confirm the target is a live Joomla frontend URL.

• info Broader Joomla route coverage completed

  Sampled 10 frontend route(s) plus bounded public Joomla surfaces for deeper evidence.

• info TLS grade: A+

  Protocol: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384 (TLSv1.3)

• info Strict-Transport-Security (HSTS): present

  max-age=31536000; includeSubDomains

• info Content-Security-Policy (CSP): present

  default-src 'self'; script-src 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com ht...

What the Joomla Stack Check Covers

This security profile for joomla.org was generated by Vulnify. The check analyzes:

• Joomla core version and vulnerability lookup
• Extension inventory and security assessment
• Template and component identification
• Security headers and configuration checks
• Exposed configuration and sensitive file checks

Prioritized Actions

• highHarden cookies
• highRestrict sensitive paths
• highAdd edge-layer deny rules
• mediumReduce public Joomla core-version disclosure
• mediumReview Joomla API exposure and access design
• mediumDisable object/embed execution
• mediumRestrict framing
• mediumRemove unsafe-inline
• mediumReplace wildcard sources
• mediumUse hardened cookie prefixes where possible
• mediumReduce disclosure headers
• lowImprove Referrer-Policy configuration
• lowImprove Permissions-Policy configuration
• lowMinimize unnecessary version or generator disclosure

About This Check

This report was generated using Vulnify's free security tools. Results reflect the configuration at the time of the check. For ongoing monitoring, detailed remediation guidance, and vulnerability scanning across 50+ security tests, create a free Vulnify account.

Last checked: October 18, 2026