Exposición de Joomla

CMS
1482
score de exposición
88.994
sitios usan
4
en explotación
89
críticos
Análisis Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 resultados
CVE-2025-32465HIGHExtension - rsjoomla.com - Stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for JoomlaEPSS 0.3%CVE-2026-76606CRITICALJoomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2EPSS 0.3%CVE-2026-81568HIGHJoomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7EPSS 0.3%CVE-2026-76611MEDIUMJoomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66EPSS 0.3%CVE-2026-48947MEDIUMJoomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpointsEPSS 0.3%CVE-2026-48945MEDIUMJoomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26EPSS 0.3%CVE-2024-27183MEDIUMExtension - dj-extensions.com - XSS vulnerability in DJ-HelpfulArticles component for Joomla 1.0.0-1.1.0EPSS 0.3%CVE-2026-65878HIGHJoomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1EPSS 0.3%CVE-2026-74253CRITICALJoomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0EPSS 0.3%CVE-2026-78072HIGHJoomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1EPSS 0.3%CVE-2025-54474HIGHExtension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for JoomlaEPSS 0.3%CVE-2026-35221MEDIUMJoomla! Core - [20260506] - Authenticated blind SQLi in com_finderEPSS 0.3%CVE-2025-49467CRITICALJoomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for JoomlaEPSS 0.3%CVE-2025-22212LOWExtension - tassos.gr - SQL injection in Convert Forms component version 1.0.0-1.0.0 - 4.4.9 for JoomlaEPSS 0.3%CVE-2026-76564HIGHJoomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7EPSS 0.3%CVE-2024-21728MEDIUMExtension - smartcalc.es - Open redirect vulnerability in osTicky component for Joomla <= 2.2.8EPSS 0.3%CVE-2026-76565MEDIUMJoomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7EPSS 0.3%CVE-2026-78073MEDIUMJoomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0EPSS 0.3%CVE-2026-75955MEDIUMJoomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3EPSS 0.3%CVE-2018-25330HIGHJoomla! EkRishta 2.10 Persistent XSS and SQL InjectionEPSS 0.3%