ScanTitan detects identifiable Joomla core, components, modules and templates using multiple external signals, then matches the detected versions against Joomla Security Announcements from the Joomla Security Strike Team, the community Vulnerable Extensions List, CVE records and the CISA Known Exploited Vulnerabilities catalog, with HTTP evidence attached to findings it can verify externally.
More than 1,400 CVEs have been published for Joomla and its extensions
Joomla 3.x reached end of life on 17 August 2023; Joomla 4.x followed in October 2025
Joomla still powers millions of websites, from small businesses to nonprofits and government portals
CVE-2023-23752 leaked Joomla configuration, including database credentials, and entered the CISA KEV catalog
A Joomla vulnerability scanner is an automated tool that inspects a Joomla site for known weaknesses in its core, components, modules, plugins and templates. It identifies the version of each component it can detect, then matches those versions against Joomla Security Announcements published by the Joomla Security Strike Team, the community Vulnerable Extensions List, and the CVE feeds.
Joomla leaves more version signals than most platforms, but a tidy site hides them: the core version lives in /administrator/manifests/files/joomla.xml, extensions leave traces under /media and /components, and the generator tag can be removed. A scanner reading one signal guesses; ScanTitan cross-checks several and shows the evidence behind what it reports.
You can run a Joomla vulnerability scan online in minutes, then add authenticated access for the extensions an external scan cannot reach. Findings are ranked by whether they are actually being exploited, not by severity language alone.
Six stages, from identifying the core version to a verified fix.
Narrows the Joomla release from the generator meta tag, the joomla.xml manifest, README.txt, the language XML, media asset versions and file signatures that differ between releases.
Extensions are detected from manifest XML, asset paths under /media, /components and /modules, and known signatures, wherever those signals are externally visible.
"Core 4.2.7" becomes the Joomla Security Announcement, CVE-2023-23752, a CVSS score, and the release that closes it. Extensions are checked against the Vulnerable Extensions List.
Readable configuration.php copies, backup archives and log files in the web root, a reachable installation folder, exposed webservices endpoints, open registration and enumerable accounts.
Anything ScanTitan can prove arrives with the underlying request and response, all from non-destructive checks. Where a result rests on version inference, the finding says so, so you never mistake a guess for a confirmation.
Ordered by CVSS, EPSS probability, CISA KEV membership and whether a public exploit exists, and each one ships with a fix plus a re-scan that confirms the issue is gone.
Why this matters: when CVE-2023-23752 was disclosed, mass scanning for the leaked configuration endpoint began within days. Sites with an accurate extension inventory patched to 4.2.8 in an afternoon; the rest first had to work out whether they were even affected.
Without credentials, the scan is limited to what any anonymous visitor can reach. On a typical Joomla site that still pins the core version range and turns up a long list of extensions, but it is not the full inventory, and no external scanner can pretend otherwise.
An extension can stay invisible from outside for several reasons: it ships no public assets, sits behind a login, exposes no version metadata, has been renamed or custom-built, never appears on the pages crawled, or hides behind a WAF or CDN. An authenticated scan closes most of that gap because it reads the Joomla Update view and the installed-extensions list from the inside.
Every finding comes with a fix matched to the component at fault: the core release to install through Joomla Update, the extension version to upgrade to, the permission to pull back, or the file to delete from the web root.
One click re-runs the scan, confirms the vulnerable release no longer shows up, and pins a clean-scan record to the issue that you can hand to an auditor or drop into a client report.
Clean stays clean, the Joomla Security Strike Team and the Vulnerable Extensions List add entries all the time. A scheduled scan, daily if you want, tells you the moment a fresh advisory names an extension you actually run.
The three levels differ in how much they probe and how much they can see. Passive and active are both unauthenticated: they only ever see what an anonymous visitor could reach. Authenticated scanning is the only level that can confirm what is actually installed.
| Scan level | How it behaves | What it can establish | Trade-off |
|---|---|---|---|
| Passive / low-impact Free external scan | Collects externally visible signals with minimal probing: the generator meta tag, public asset paths, response headers and readable manifests | Core version or version range, template in use, extension signals that are publicly advertised, and basic advisory matching against detected versions | Lightest footprint and fastest, but the thinnest inventory |
| Active external Deep scan | Sends additional requests to enumerate and test publicly reachable Joomla behaviour, without logging in and without exploit payloads | Broader component, module and template enumeration, additional endpoint and path checks, exposed files and backups, a reachable installation folder, open registration and account enumeration | Considerably more requests, so it is rate-limited and best scheduled off-peak |
| Authenticated Credentialed scan | Uses authorized credentials to inspect admin-side views an external scan cannot reach | Confirmed core version from Joomla Update, extensions that are installed but externally invisible, disabled, renamed or custom, ACL and permission visibility, and global configuration state such as error reporting and debug settings | Requires access you must grant and trust, so it is opt-in per site |
All three levels are non-destructive. No exploit payloads are sent and nothing is written to your site. Findings state which signal produced them, so a version-inference result is never presented as a confirmed one.
Joomla is one of the most widely deployed open-source content management systems, which makes it a standing target for automated attacks. The core is comparatively hardened; the risk concentrates in third-party extensions of wildly varying quality and in sites left on an unsupported branch, and mass scanning starts within days of a serious advisory.
|
How Joomla sites get compromised |
Documented example | What ScanTitan looks for |
|---|---|---|
| Unpatched core advisory | Critical CVE-2023-23752, unauthenticated information disclosure in the Joomla webservices, leaking configuration including database credentials, affecting 4.0.0 to 4.2.7, in CISA KEV | The detected core version, lined up against the Joomla Security Announcements that apply |
| Vulnerable extensions | Most breaches Third-party components, modules and plugins with SQL injection, XSS or file upload flaws, tracked on the community Vulnerable Extensions List | Detected extension versions, checked against the Vulnerable Extensions List and CVE records |
| End-of-life core branches | No fixes ever Joomla 3.x ended support on 17 August 2023 and Joomla 4.x on 14 October 2025, yet many sites still run them | End-of-life detection, how much coverage time is left, and the findings that will never see an upstream patch |
| Exposed files and config | High Readable configuration.php backups, leftover installation folders and directory listing that hand an attacker credentials or a version to target | Exposed configuration copies, backups, logs, reachable installation folder and open webservices |
Advisory identifiers, CVE records and severity ratings are published by the Joomla Security Strike Team, NVD and CISA. ScanTitan maps findings to those identifiers rather than inventing its own severity language.
On an unsupported branch, a scan result is not a to-do list, it is a migration business case. Joomla 6 is the current major series, released in October 2025; Joomla 5.4 is the last minor of the 5.x line and is now in its security-fix window. Status below reflects the Joomla roadmap as of August 2026; confirm the current minor before you plan around it.
| Branch | Status | Security coverage | What it means |
|---|---|---|---|
| Joomla 6.1.x | Current | Active bugfix and security support | 6.1.2 is the latest release, from 7 July 2026. The target for new builds and the longest runway available |
| Joomla 6.0.x | Superseded | Covered by the 6.x series | Move to the current 6.1 minor to receive fixes promptly |
| Joomla 5.4.x | Supported | Bugfix support to 13 October 2026, security fixes to 12 October 2027 | Not at risk today, but 5.4 is the final 5.x minor, so plan the move to 6.x |
| Joomla 5.0 to 5.3 | Superseded | Fixes ship in 5.4.x only | Update to the current 5.4 minor at minimum |
| Joomla 4.x | End of life | Security support ended 14 October 2025 | From here on, every new core advisory stays open for good |
| Joomla 3.10.x and earlier | End of life | Ended 17 August 2023 | Unsupported for years; migrate to a current branch |
Advisory identifiers, CVE records and severity ratings are published by the Joomla Security Strike Team, NVD and CISA. ScanTitan maps findings to those identifiers rather than inventing its own severity language.
A few Joomla CVEs changed how the community thinks about patch windows. CVE-2015-8562 was an unauthenticated remote code execution triggered by a crafted HTTP User-Agent or X-Forwarded-For header, affecting Joomla 1.5.0 through 3.4.5, and it was mass-exploited within days of disclosure in December 2015. CVE-2023-23752 was an unauthenticated information disclosure in the Joomla webservices that leaked the site configuration, including database credentials, affecting 4.0.0 through 4.2.7, and it sits in the CISA KEV catalog. CVE-2016-8869 and CVE-2016-8870 allowed account creation and privilege escalation through registration.
Eight years apart, CVE-2015-8562 and CVE-2023-23752 are the same story: an unauthenticated flaw reachable by any visitor, mass-scanned within days. Automated tooling never stopped scanning for the old chains, and every abandoned Joomla 1.5 or 3.x install is still a match. ScanTitan checks the historic exploits and current advisories in the same pass.
The Joomla attack surface, not just a core version number.
Narrows the Joomla release from the generator meta tag, the joomla.xml manifest, README.txt, the language XML, media asset versions and file-level signatures.
Identifies components, modules, plugins and templates from manifest XML, asset paths under /media, /components and /modules, and known signatures, with authenticated access filling what external signals miss.
Flags end-of-life core branches and scores extensions with no advisory but real risk: no release in years, removed from the Joomla Extensions Directory, or already listed on the Vulnerable Extensions List.
Findings carry the Joomla Security Announcement reference, the CVE record and CVSS 3.1 score, plus EPSS probability, CISA KEV status and public exploit availability where available.
Readable configuration.php copies and swap files, .env and composer.lock, error and access logs, directory listing left enabled, exposed version control directories, a leftover installation folder, and Akeeba or manual backup archives in the web root.
A publicly reachable Joomla Web Services API at /api/index.php/v1, write access granted to public roles, an exposed administrator login endpoint, enumerable usernames, open registration, weak two-factor coverage and missing brute-force protection.
A Joomla extension vulnerability is usually a maintenance problem before it is a code problem, which is why unmaintained extensions are scored even without an advisory. Detection coverage depends on what a site exposes: extensions with no public assets, custom or renamed projects, and sites behind a restrictive WAF or CDN may need authenticated access to be identified.
People searching for a Joomla exploit scanner want one of two things: a tool that fires exploit code at a site, which is a penetration testing decision, or a scanner that knows which findings attackers are using now. ScanTitan does the second, deliberately not the first, using public sources you can verify.
A Joomla vulnerability scanner finds weaknesses before they are exploited: unpatched core, outdated extensions, exposed configuration and backups, over-permissive webservices access. A Joomla malware scan finds the damage after a breach: injected PHP in /images or /tmp, backdoors, spam redirects, unexpected Super User accounts.
Running only a malware scanner is like watching for burglars while leaving the front door unlocked.
Proactive. Surfaces exploitable core, extensions, templates and exposed files so you can shut them before anyone tries.
Reactive. Hunts backdoors and injected code on a site that is already compromised. See ScanTitan malware removal.
Both run on the same ScanTitan platform and share a single asset view.
People searching for a Joomla exploit scanner want one of two things: a tool that fires exploit code at a site, which is a penetration testing decision, or a scanner that knows which findings attackers are using now. ScanTitan does the second, deliberately not the first, using public sources you can verify.
CVE-2023-23752 went from disclosure to mass exploitation in days and entered the CISA KEV catalog. Many Joomla advisories, by contrast, describe issues that need admin access or a specific configuration. Severity language alone will not tell you which is which.
Confirmed exploitation in the wild, carrying a binding federal remediation deadline under BOD 22-01, shown right on the finding. KEV catalog
FIRST's read on how likely exploitation is over the next 30 days, frequently a sharper patch-order cue than CVSS on its own. FIRST EPSS
Whether a working proof of concept or Metasploit module is out there, as it is for the older Joomla chains, kept on the finding instead of buried. Exploit-DB
Written for two readers at once: the developer applying the update and the owner who has to explain the risk. Export it as PDF, JSON or HTML.
The detected core, components, modules and templates with their versions and support status, alongside anything an external view could not pin down.
Each finding linked to its Joomla Security Announcement or Vulnerable Extensions List entry, CVE record and CVSS score.
The request and response that prove each verifiable finding, plus the exact change that closes it.
Whether your branch still gets fixes at all, and which findings have no upstream patch coming.
Authenticated scanning hands a third party keys to a production site. Agencies and owners should know exactly how that access is treated before they connect anything, so the answers are laid out here up front.
Authenticated access runs through a dedicated least-privilege account or connector token that you issue and can pull back whenever you want. Those credentials are encrypted in transit and at rest in a managed secrets store, used only to run your scans, and wiped when you remove the connection.
Inside your organisation, access follows roles. Support staff cannot read stored secrets, and any look at your data for troubleshooting happens only at your request and lands in an audit trail.
Results stay only as long as your workspace settings say. You can remove a single scan, a whole site or your entire history whenever you like, and doing so clears the evidence and exports attached to it.
Every scan comes from a published set of static IP ranges, so you can allowlist them at your WAF, CDN or firewall and tell our traffic apart from an attacker's in your logs.
The checks stay non-destructive: no exploit payloads, nothing written to the site. Request rates are capped by default, adjustable per site, and deep scans can run off-peak.
You choose the region where scan data is processed and stored, which matters when your team has residency obligations. Ask us for the current region list and subprocessor details.
Updating removes known vulnerabilities. Joomla hardening removes the conditions that make the next one cheap to exploit: a protected or renamed administrator login, configuration.php set read-only, backups and logs outside the web root, the installation folder removed, directory listing disabled, error reporting set to None in production, two-factor authentication on Super User accounts, tight brute-force and flood control, and a security extension such as Admin Tools enforcing headers and a web application firewall. ScanTitan reports these as configuration findings with the setting to change.
The built-in Joomla! Update component, the extensions update view, and the Vulnerable Extensions plugin that ships in Joomla 4 and 5 answer "are my versions current" from the inside. Free, precise, and blind to external exposure.
External and continuous, covering configuration and exposure on top of versions. It catches known, detectable issues, not the logic flaws specific to your own build.
A hands-on engagement where people review custom code, ACL logic and integrations, usually alongside a scoped penetration test. Audit vs scanner, compared.
An agency maintains thirty client Joomla builds on different versions; a nonprofit runs several sites off one team. ScanTitan watches every property from one dashboard, triggers scans from the API, and alerts the right person when a site turns vulnerable.
curl -X POST https://api.scantitan.com/v1/joomla-scans \ -H "Authorization: Bearer YOUR_API_KEY" \ -d '{ "target": "https://portal.example.com", "scan_type": "authenticated", "notify": ["slack","email"] }' # Response { "scan_id": "jm_7c1e93", "core_version": "4.2.7", "extensions_detected": 22 }
A single dashboard across every site and version. Findings feed into the tools your team already runs, and white-label reports make quiet security work something a client can see.
All sites, one screen
Daily / weekly / monthly
Auto-create tickets
Core, extensions, templates
Client-ready reports
Advisory alerts
Last reviewed 12 August 2026, and reviewed again every 90 days.
July 2026
Detected components, modules and plugins are now matched against the latest community Vulnerable Extensions List entries on every scan, so a newly listed extension is flagged the day it is added.
June 2026
Added Joomla 6.0 and 6.1 minor detection alongside the current Joomla 5.4 line, and expanded checks for a publicly reachable Joomla Web Services API at /api/index.php/v1, the surface behind CVE-2023-23752 and CVE-2026-48958.
April 2026
Joomla 3.x and 4.x are now reported as end of life with their coverage cutoffs, so an unsupported branch reads as a migration decision rather than a patch list.
February 2026
Broader detection for readable configuration.php copies, leftover installation folders and backup archives that disclose credentials or a version to target.
These are all real tools, and the open-source ones enumerate very well. The table below reflects what each vendor’s own documentation claims, not our judgement of them.
| ScanTitan | OWASP JoomScan | JoomlaVS | Pentest-Tools | HackerTarget | |
|---|---|---|---|---|---|
|
Core, extension and template discovery |
✓ | ✓ | ✓ | ✓ | ✓ |
|
Advisory and CVE matching |
✓ | Version-based | Version-based | ✓ | Partial |
|
Vulnerable Extensions List mapping |
✓ | Own DB | Own DB | Partial | Not documented |
|
CISA KEV and EPSS exploitation context |
✓ | Not documented | Not documented | Partial | Not documented |
| Authenticated scanning | ✓ | Not documented | Not documented | ✓ | Partial |
|
HTTP evidence on each finding |
✓ | CLI output | CLI output | ✓ | Not documented |
|
End-of-life branch reporting |
✓ | Not documented | Not documented | Not documented | Not documented |
|
Scheduled portfolio scanning across sites |
✓ | Not documented | Not documented | Partial | Membership |
| Entry point | Free scan | Open source CLI | Open source CLI | Paid, free light | Free basic |
A fintech shipping a REST API imported its OpenAPI spec and, on the first authenticated scan, found a BOLA flaw on the /accounts/{id} endpoint that returned any user’s balance by changing the ID. Fixed and re-verified in a day, before any bug bounty report.
How to read this table. ✓ the capability is described in the tool’s official documentation. Version-based matches on detected version against the tool’s own database rather than mapping to advisory and CVE identifiers. Own DB maintains its own vulnerability data rather than mapping to the community Vulnerable Extensions List. CLI output prints requests to the terminal but does not attach structured evidence to a managed finding. Partial available with documented limits, or only in a paid tier. Membership requires a paid membership tier on that platform. Not documented means we found no description of the capability in the sources below at the time of review; it is not a claim that the tool cannot do it.
Sources reviewed 12 August 2026: OWASP JoomScan repository · JoomlaVS repository · Pentest-Tools Joomla Scanner · HackerTarget Joomla Security Scan.
Next scheduled review: November 2026. Spotted something out of date? Tell us and we will correct it.
These come from our security team, not a chatbot.
It is an automated tool that checks a live Joomla site for known weaknesses across the core, components, modules, plugins and templates. It reads the version of each part it can detect, then lines those versions up against the Joomla Security Announcements from the Joomla Security Strike Team, the community Vulnerable Extensions List and the CVE feeds. Where a malware scanner spots code that is already malicious, a vulnerability scanner finds what an attacker could turn into an entry point first.
Paste your URL and start an unauthenticated scan; it reads the core, extensions and templates from external signals in a few minutes, with nothing to install. Connect authenticated access when you want admin-side depth. ScanTitan matches the detected versions to Joomla Security Announcements, the Vulnerable Extensions List and CVE records, and hands each finding to you with its severity, exploit status and the release that closes it.
An unauthenticated scan only sees what an anonymous visitor sees, so it is never a full inventory. An extension can slip past it when it ships no public assets, sits behind a login, exposes no version metadata, has been renamed or custom-built, never shows on the pages crawled, or hides behind a WAF or CDN. Authenticated access closes most of that gap by reading the Joomla Update and installed-extensions views directly.
No. ScanTitan keeps its checks non-destructive: it looks for signs that a vulnerable version or exposed path exists without ever running exploit code, and it writes nothing to your site. Throwing live payloads at production is a scoped penetration test instead. What ScanTitan adds is exploit context: whether a finding is in CISA KEV, its EPSS probability, and whether a public exploit exists.
Yes, for any extension it can identify, and that is exactly where most real Joomla exposure sits. ScanTitan spots third-party components, modules, plugins and templates from manifest XML, asset paths and known signatures, then checks them against the community Vulnerable Extensions List and CVE records. Even without a current advisory, it flags extensions that are abandoned, pulled from the Joomla Extensions Directory, or already named on the VEL.
Passive scanning gathers only the signals a site already exposes, with minimal probing, things like the generator meta tag, public asset paths and response headers. Active external scanning goes further, sending extra requests to enumerate and test publicly reachable Joomla behaviour, though still without logging in and still without exploit payloads. Authenticated scanning uses credentials you approve to read admin-side views, the one level that can confirm the installed version and reveal extensions that expose nothing in public. Passive and active both stop at whatever an anonymous visitor could reach.
Nothing breaks that day and the site keeps serving traffic. What ends is the supply of security fixes. Joomla 3.x reached end of life on 17 August 2023 and Joomla 4.x reached end of life in October 2025, so from those dates on, any new core issue stays open for good. That turns a scan result on an unsupported branch into a migration business case rather than a to-do list.
The checks are non-destructive: no exploit payloads go out and nothing is written to your site. An unauthenticated scan stays light. A deep authenticated scan sends a lot more traffic, so request rates are capped by default, adjustable per site, and easy to schedule off-peak. Every scan comes from published static IP ranges you can allowlist.
ScanTitan checks the Joomla core, extensions and templates it can detect against Joomla Security Announcements, the Vulnerable Extensions List, CVE records and the CISA KEV catalog, then tells you what to patch first.
Proof-based vulnerability scanning for websites, CMS platforms, cloud environments and everything you have exposed to the internet.
OWASP JoomScan is a free, open-source command-line enumerator that fingerprints the core and lists extensions very well. ScanTitan runs online with nothing to install, maps detected versions to Joomla Security Announcements, the Vulnerable Extensions List and CVE records, layers on CISA KEV and EPSS exploitation context, attaches HTTP evidence to verifiable findings, and adds authenticated and scheduled multi-site scanning. Reach for JoomScan when you want a quick command-line enumeration; reach for ScanTitan when you want continuous, evidence-backed monitoring.
ScanTitan checks the Joomla core, extensions and templates it can detect against Joomla Security Announcements, the Vulnerable Extensions List, CVE records and the CISA KEV catalog, then tells you what to patch first.
OSCP · CISSP · 12 years in web application security · Author profile →