Exposure of Joomla

CMS
1,616
exposure score
84,613
sites use
6
exploited
108
critical

CVEs

560 results
CVE-2026-74254CRITICALJoomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5EPSS 0.4%CVE-2026-77994CRITICALJoomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5EPSS 0.4%CVE-2026-65876CRITICALJoomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0EPSS 0.4%CVE-2026-67365CRITICALJoomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11EPSS 0.4%CVE-2026-81567HIGHJoomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7EPSS 0.4%CVE-2026-21625MEDIUMExtension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for JoomlaEPSS 0.4%CVE-2026-65877HIGHJoomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1EPSS 0.4%CVE-2026-63048CRITICALJoomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2EPSS 0.4%CVE-2026-107130MEDIUMJoomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0EPSS 0.4%CVE-2023-23756—Extension - advcomsys.com - XSS in oneVote component for Joomla <= 1.7.0EPSS 0.4%CVE-2026-102424HIGHJoomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4EPSS 0.4%CVE-2026-102775HIGHJoomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8EPSS 0.4%CVE-2023-28733HIGHStored XSS affecting the AcyMailing plugin for Joomla EPSS 0.4%CVE-2025-54294CRITICALExtension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for JoomlaEPSS 0.4%CVE-2026-71571HIGHJoomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11EPSS 0.4%CVE-2026-78375HIGHJoomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0EPSS 0.4%CVE-2026-76613HIGHJoomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40EPSS 0.4%CVE-2026-90901HIGHJoomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0EPSS 0.4%CVE-2026-88855HIGHJoomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7EPSS 0.4%CVE-2026-78070MEDIUMJoomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2EPSS 0.4%