Exposure of Joomla

CMS
1,482
exposure score
88,994
sites use
4
exploited
89
critical
Vexday analysis

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 results
CVE-2025-54298CRITICALExtension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for JoomlaEPSS 0.4%CVE-2026-60030HIGHJoomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1EPSS 0.4%CVE-2023-23754MEDIUM[20230501] - Core - Open Redirect and XSS within the mfa selectEPSS 0.4%CVE-2023-40659—Extension - joomboost.com - Reflected XSS in Easy Quick Contact module for Joomla 1.0.0-1.3.0EPSS 0.4%CVE-2023-40658—Extension - deconf.net - Reflected XSS in Clicky Analytics Dashboard module for Joomla 1.0.0-1.3.1EPSS 0.4%CVE-2023-40657—Extension - artio.net - Reflected XSS in Joomdoc component for Joomla 1.0.0-4.0.5EPSS 0.4%CVE-2023-40656—Extension - plasma-web.ru - Reflected XSS in Quickform component for Joomla 1.0.0-3.3.01EPSS 0.4%CVE-2023-40655—Extension - mooj.org - Reflected XSS in Proforms Basic component for Joomla <= 1.6.0EPSS 0.4%CVE-2023-40627—Extension - MLWebTechnologies - Reflected XSS in LivingWord component for Joomla 1.0.0-3.0.0EPSS 0.4%CVE-2023-40628—Extension - Extplorer.net - Reflected XSS in Extplorer component for Joomla 1.0.0-2.1.15EPSS 0.4%CVE-2026-62414CRITICALJoomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2EPSS 0.4%CVE-2026-58078HIGHJoomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1EPSS 0.4%CVE-2026-57832HIGHJoomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9EPSS 0.4%CVE-2026-57831HIGHJoomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2EPSS 0.4%CVE-2026-23899HIGHJoomla! Core - [20260306] - Improper access check in webservice endpointsEPSS 0.4%CVE-2020-35615—[20201106] - Core - CSRF in com_privacy emailexport featureEPSS 0.4%CVE-2023-39973—Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.4%CVE-2023-39972—Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.4%CVE-2023-39971—Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.4%CVE-2025-25227HIGH[20250402] - Joomla Core - MFA Authentication BypassEPSS 0.4%