Exposure of Joomla

CMS
1,482
exposure score
88,994
sites use
4
exploited
89
critical
Vexday analysis

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 results
CVE-2025-54295MEDIUMExtension - dj-extensions.com - Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for JoomlaEPSS 0.3%CVE-2021-47930HIGHBalbooa Joomla Forms Builder 2.0.6 SQL Injection UnauthenticatedEPSS 0.3%CVE-2024-21727MEDIUMExtension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14EPSS 0.3%CVE-2026-78374MEDIUMJoomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0EPSS 0.3%CVE-2025-32466MEDIUMExtension - rsjoomla.com - SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for JoomlaEPSS 0.3%CVE-2026-67287MEDIUMJoomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0EPSS 0.3%CVE-2026-78071HIGHJoomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0EPSS 0.3%CVE-2026-75953HIGHJoomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3EPSS 0.3%CVE-2026-48943MEDIUMJoomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26EPSS 0.3%CVE-2026-65887CRITICALJoomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2EPSS 0.3%CVE-2025-50127HIGHExtension - dj-extensions.com - SQLi vulnerability in DJ-Flyer component 1.0-3.2 for JoomlaEPSS 0.3%CVE-2025-27444MEDIUMExtension - rsjoomla.com - A reflected XSS vulnerability RSform!Pro component 3.0.0 - 3.3.13 for JoomlaEPSS 0.3%CVE-2026-48896HIGHJoomla! Core - [20260511] - MFA Authentication BypassEPSS 0.3%CVE-2025-22209MEDIUMExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for JoomlaEPSS 0.3%CVE-2025-49486HIGHExtension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for JoomlaEPSS 0.3%CVE-2026-77995CRITICALJoomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2EPSS 0.3%CVE-2026-76599HIGHJoomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2EPSS 0.3%CVE-2026-75951MEDIUMJoomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3EPSS 0.3%CVE-2026-75950MEDIUMJoomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3EPSS 0.3%CVE-2026-76608MEDIUMJoomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2EPSS 0.3%