Exposición de Joomla

CMS
1482
score de exposición
88.994
sitios usan
4
en explotación
89
críticos
Análisis Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 resultados
CVE-2026-65881HIGHJoomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1EPSS 0.2%CVE-2026-64794MEDIUMJoomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensionsEPSS 0.2%CVE-2026-48952MEDIUMJoomla! Core - [20260706] - XSS in com_installerEPSS 0.2%CVE-2026-48950MEDIUMJoomla! Core - [20260704] - XSS in com_templatesEPSS 0.2%CVE-2026-48951MEDIUMJoomla! Core - [20260705] - XSS in various modalreturn layoutsEPSS 0.2%CVE-2026-48954MEDIUMJoomla! Core - [20260708] - XSS through language overridesEPSS 0.2%CVE-2026-48953MEDIUMJoomla! Core - [20260707] - XSS in the generic image output layoutEPSS 0.2%CVE-2026-48949MEDIUMJoomla! Core - [20260703] - XSS in MFA method managementEPSS 0.2%CVE-2026-77028MEDIUMJoomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66EPSS 0.2%CVE-2026-71570MEDIUMJoomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11EPSS 0.2%CVE-2026-61901MEDIUMJoomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2EPSS 0.2%CVE-2026-76607CRITICALJoomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2EPSS 0.2%CVE-2026-78069CRITICALJoomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6EPSS 0.2%CVE-2026-78064HIGHJoomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6EPSS 0.2%CVE-2026-76596HIGHJoomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2EPSS 0.2%CVE-2026-77034MEDIUMJoomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1EPSS 0.2%CVE-2026-76603MEDIUMJoomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2EPSS 0.2%CVE-2026-76609MEDIUMJoomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2EPSS 0.2%CVE-2026-76600MEDIUMJoomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2EPSS 0.2%CVE-2026-67360MEDIUMJoomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.2%