Exposure of Joomla

CMS
1,616
exposure score
84,613
sites use
6
exploited
108
critical

CVEs

560 results
CVE-2026-57827CRITICALJoomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12EPSS 2.3%CVE-2022-23793—[20220301] - Core - Zip Slip within the Tar extractorEPSS 2.1%CVE-2011-1151—Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.EPSS 1.9%CVE-2023-28731CRITICALUnauthenticated RCE affecting the AcyMailing plugin for JoomlaEPSS 1.8%CVE-2013-3932—SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "BusineEPSS 1.8%CVE-2020-35612—[20201103] - Core - Path traversal in mod_random_imageEPSS 1.6%CVE-2011-4937—Joomla! 1.7.1 has core information disclosure due to inadequate error checking.EPSS 1.6%CVE-2026-66914CRITICALJoomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1EPSS 1.5%CVE-2026-56292CRITICALJoomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1EPSS 1.4%CVE-2021-23128—[20210302] - Core - Potential Insecure FOFEncryptRandvalEPSS 1.4%CVE-2021-23127—[20210301] - Core - Insecure randomness within 2FA secret generationEPSS 1.4%CVE-2021-23131—[20210305] - Core - Input validation within the template managerEPSS 1.4%CVE-2020-35610—[20201101] - Core - com_finder ignores access levels on autosuggestEPSS 1.4%CVE-2020-35611—[20201102] - Core - Disclosure of secrets in Global Configuration pageEPSS 1.3%CVE-2026-97160CRITICALJoomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29EPSS 1.3%CVE-2022-23799—[20220307] - Core - Variable Tampering on JInput $_REQUEST dataEPSS 1.2%CVE-2021-26036—[20210702] - Core - DoS through usergroup table manipulationEPSS 1.2%CVE-2021-23123—[20210101] - Core - com_modules exposes module namesEPSS 1.2%CVE-2017-2550—Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename.EPSS 1.2%CVE-2022-23795—[20220303] - Core - User row are not bound to a authentication mechanismEPSS 1.1%