Exposure of Joomla

CMS
1,482
exposure score
88,994
sites use
4
exploited
89
critical
Vexday analysis

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 results
CVE-2026-74251CRITICALJoomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6EPSS 0.4%CVE-2023-28733HIGHStored XSS affecting the AcyMailing plugin for Joomla EPSS 0.4%CVE-2026-65886CRITICALJoomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2EPSS 0.4%CVE-2026-78085MEDIUMJoomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4EPSS 0.4%CVE-2026-73373HIGHJoomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2EPSS 0.4%CVE-2025-50058MEDIUMExtension - rsjoomla.com - Stored XSS vulnerability in RSDirectory! component 1.16.3-1.17.7 for JoomlaEPSS 0.4%CVE-2025-22211LOWExtension - webdesigner-profi.de - SQL injection in JoomShopping component version 1.0.0 - 5.5.5 for JoomlaEPSS 0.4%CVE-2024-27187HIGH[20240804] - Core - Improper ACL for backend profile viewEPSS 0.4%CVE-2023-38045—Extension - admiror-design-studio.com - XSS in Admiror Gallery component for Joomla 5.0.0-5.2.0EPSS 0.4%CVE-2026-76597HIGHJoomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2EPSS 0.4%CVE-2026-35223HIGHJoomla! Core - [20260508] - Improper access check in com_config webservice endpointsEPSS 0.3%CVE-2026-76612HIGHJoomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66EPSS 0.3%CVE-2026-48955MEDIUMJoomla! Core - [20260709] - Incorrect Access Control in com_workflowEPSS 0.3%CVE-2026-58149MEDIUMJoomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0EPSS 0.3%CVE-2026-88854CRITICALJoomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7EPSS 0.3%CVE-2025-50126MEDIUMExtension - rsjoomla.com - Stored XSS vulnerability RSBlog! component 1.11.6-1.14.5 for JoomlaEPSS 0.3%CVE-2026-21630MEDIUMJoomla! Core - [20260302] - SQL injection in com_content articles webservice endpointEPSS 0.3%CVE-2026-77998CRITICALJoomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4EPSS 0.3%CVE-2026-67362MEDIUMJoomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.3%CVE-2026-65754HIGHJoomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extensionEPSS 0.3%