Exposure of Joomla

CMS
1,482
exposure score
88,994
sites use
4
exploited
89
critical
Vexday analysis

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 results
CVE-2026-77992CRITICALJoomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2EPSS 0.3%CVE-2026-67359HIGHJoomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.3%CVE-2026-78079MEDIUMJoomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10EPSS 0.3%CVE-2026-77027HIGHJoomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2EPSS 0.3%CVE-2026-78302HIGHJoomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4EPSS 0.3%CVE-2026-77989MEDIUMJoomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1EPSS 0.3%CVE-2026-85196MEDIUMJoomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0EPSS 0.3%CVE-2026-76569MEDIUMJoomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4EPSS 0.3%CVE-2026-77993MEDIUMJoomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5EPSS 0.3%CVE-2026-65764MEDIUMJoomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1EPSS 0.3%CVE-2026-78078HIGHJoomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10EPSS 0.3%CVE-2026-65891MEDIUMJoomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10EPSS 0.3%CVE-2024-27184MEDIUM[20240801] - Core - Inadequate validation of internal URLsEPSS 0.3%CVE-2026-57829HIGHJoomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7EPSS 0.3%CVE-2026-82189HIGHJoomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7EPSS 0.3%CVE-2026-77999HIGHJoomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6EPSS 0.3%CVE-2026-78303MEDIUMJoomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4EPSS 0.3%CVE-2026-65756MEDIUMJoomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extensionEPSS 0.3%CVE-2026-48942MEDIUMJoomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26EPSS 0.3%CVE-2026-48902CRITICALJoomla! Core - [20260518] - Transport encryption downgrade for password and username reset linksEPSS 0.3%