Exposición de Joomla

CMS
1482
score de exposición
88.994
sitios usan
4
en explotación
89
críticos
Análisis Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 resultados
CVE-2026-67363HIGHJoomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2EPSS 0.3%CVE-2025-54294CRITICALExtension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for JoomlaEPSS 0.3%CVE-2025-54301HIGHExtension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for JoomlaEPSS 0.3%CVE-2025-54300HIGHExtension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for JoomlaEPSS 0.3%CVE-2026-65758HIGHJoomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2EPSS 0.3%CVE-2026-78000MEDIUMJoomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.3%CVE-2025-54476MEDIUMJoomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter codeEPSS 0.3%CVE-2026-64799HIGHJoomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensionsEPSS 0.3%CVE-2026-81564HIGHJoomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0EPSS 0.3%CVE-2026-75115HIGHJoomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40EPSS 0.3%CVE-2026-81565MEDIUMJoomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0EPSS 0.3%CVE-2026-65765MEDIUMJoomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1EPSS 0.3%CVE-2026-75949CRITICALJoomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3EPSS 0.3%CVE-2026-74803CRITICALJoomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64EPSS 0.3%CVE-2026-75956HIGHJoomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3EPSS 0.3%CVE-2017-20277HIGHJoomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_authorEPSS 0.3%CVE-2026-76598HIGHJoomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2EPSS 0.3%CVE-2026-84048MEDIUMJoomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2EPSS 0.3%CVE-2026-78074HIGHJoomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensionsEPSS 0.3%CVE-2026-35222MEDIUMJoomla! Core - [20260507] - Authenticated blind SQLi in com_tagsEPSS 0.3%