Exposure of Joomla

CMS
1,482
exposure score
88,994
sites use
4
exploited
89
critical
Vexday analysis

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 results
CVE-2024-40747MEDIUM[20250101] - Core - XSS vectors in module chromesEPSS 0.3%CVE-2026-76602CRITICALJoomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2EPSS 0.2%CVE-2026-64792HIGHJoomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensionsEPSS 0.2%CVE-2026-71573MEDIUMJoomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2EPSS 0.2%CVE-2026-21629MEDIUMJoomla! Core - [20260301] - ACL hardening in com_ajaxEPSS 0.2%CVE-2025-25228LOWExtension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for JoomlaEPSS 0.2%CVE-2026-23900MEDIUMExtension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for JoomlaEPSS 0.2%CVE-2026-85195HIGHJoomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0EPSS 0.2%CVE-2026-88853HIGHJoomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0EPSS 0.2%CVE-2026-88852HIGHJoomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0EPSS 0.2%CVE-2026-77996HIGHJoomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41EPSS 0.2%CVE-2026-85191HIGHJoomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0EPSS 0.2%CVE-2026-85190HIGHJoomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5EPSS 0.2%CVE-2026-85189HIGHJoomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0EPSS 0.2%CVE-2026-67283MEDIUMJoomla Extension - tabaoca.org - Improper ACL implementation allows allow file operations in Cotton Cloud < 2.0.2EPSS 0.2%CVE-2026-64793CRITICALJoomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensionsEPSS 0.2%CVE-2026-64798CRITICALJoomla Extension - regularlabs.com - Insecure login URL keys in IP login extensionEPSS 0.2%CVE-2026-65755HIGHJoomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extensionEPSS 0.2%CVE-2026-48901HIGHJoomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objectsEPSS 0.2%CVE-2026-65430HIGHJoomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extensionEPSS 0.2%