Exposure of Joomla

CMS
1,616
exposure score
84,613
sites use
6
exploited
108
critical

CVEs

560 results
CVE-2026-63047HIGHJoomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1EPSS 0.4%CVE-2026-65943HIGHJoomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0EPSS 0.4%CVE-2026-102802HIGHJoomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1EPSS 0.4%CVE-2026-105600HIGHJoomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5EPSS 0.4%CVE-2026-75948HIGHJoomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12EPSS 0.4%CVE-2026-102800HIGHJoomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0EPSS 0.4%CVE-2024-40749HIGH[20250103] - Core - Read ACL violation in multiple core viewsEPSS 0.4%CVE-2026-78075MEDIUMJoomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10EPSS 0.4%CVE-2026-60033MEDIUMJoomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0EPSS 0.4%CVE-2026-77035MEDIUMJoomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1EPSS 0.4%CVE-2026-77997MEDIUMJoomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40EPSS 0.4%CVE-2026-78076MEDIUMJoomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10EPSS 0.4%CVE-2026-81566MEDIUMJoomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0EPSS 0.4%CVE-2026-63683HIGHJoomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions managerEPSS 0.4%CVE-2026-75954CRITICALJoomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3EPSS 0.4%CVE-2026-102788CRITICALJoomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2EPSS 0.4%CVE-2026-88854CRITICALJoomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7EPSS 0.4%CVE-2026-74804CRITICALJoomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64EPSS 0.4%CVE-2026-76602CRITICALJoomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2EPSS 0.4%CVE-2026-78080CRITICALJoomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0EPSS 0.4%