Exposição de Joomla

CMS
1.616
score de exposição
84.613
sites usam
6
em exploração
108
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

560 resultados
CVE-2026-23898HIGHJoomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdateEPSS 0.5%CVE-2025-27445MEDIUMExtension - rsjoomla.com - A path traversal vulnerability RSFirewall component 2.9.7 - 3.1.5 for JoomlaEPSS 0.5%CVE-2026-48958MEDIUMJoomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpointsEPSS 0.5%CVE-2026-76570CRITICALJoomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1EPSS 0.5%CVE-2017-20277HIGHJoomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_authorEPSS 0.5%CVE-2026-77026MEDIUMJoomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5EPSS 0.5%CVE-2026-79701MEDIUMJoomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0EPSS 0.5%CVE-2026-79700MEDIUMJoomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0EPSS 0.5%CVE-2025-50057MEDIUMExtension - rsjoomla.com - DOS vulnerability RSFiles! component 1.16.3-1.17.7 for JoomlaEPSS 0.5%CVE-2025-26855CRITICALExtension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for JoomlaEPSS 0.5%CVE-2025-26854CRITICALExtension - joomcar.net - SQL injection in Articles Good Search 1.0.0 - 1.2.4.0011 for JoomlaEPSS 0.5%CVE-2025-22207MEDIUM[20250201] - Core - SQL injection vulnerability in Scheduled Tasks componentEPSS 0.4%CVE-2026-82191MEDIUMJoomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7EPSS 0.4%CVE-2024-26278MEDIUM[20240705] - Core - XSS in com_fields default field valueEPSS 0.4%CVE-2026-62415CRITICALJoomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2EPSS 0.4%CVE-2026-61900CRITICALJoomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6EPSS 0.4%CVE-2026-61424CRITICALJoomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2EPSS 0.4%CVE-2025-54473CRITICALExtension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for JoomlaEPSS 0.4%CVE-2026-77992CRITICALJoomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2EPSS 0.4%CVE-2026-78072HIGHJoomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1EPSS 0.4%