Exposição de Joomla

CMS
1.616
score de exposição
84.613
sites usam
6
em exploração
108
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

560 resultados
CVE-2023-23751MEDIUM[20230102] - Core - Missing ACL checks for com_actionlogsEPSS 0.4%CVE-2026-48944MEDIUMJoomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26EPSS 0.4%CVE-2024-21731MEDIUM[20240703] - Core - XSS in StringHelper::truncate methodEPSS 0.4%CVE-2024-21729MEDIUM[20240701] - Core - XSS in accessible media selection fieldEPSS 0.4%CVE-2025-50056MEDIUMExtension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.28 for JoomlaEPSS 0.4%CVE-2024-27185CRITICAL[20240802] - Core - Cache Poisoning in PaginationEPSS 0.4%CVE-2026-76597HIGHJoomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2EPSS 0.4%CVE-2022-27913—[20221002] - Core - RXSS through reflection of user input in headingsEPSS 0.4%CVE-2026-65889CRITICALJoomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2EPSS 0.4%CVE-2026-58077HIGHJoomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2EPSS 0.4%CVE-2026-58148HIGHJoomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52EPSS 0.4%CVE-2026-57833HIGHJoomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2EPSS 0.4%CVE-2026-76564HIGHJoomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7EPSS 0.4%CVE-2026-77027HIGHJoomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2EPSS 0.4%CVE-2026-76612HIGHJoomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66EPSS 0.4%CVE-2026-78302HIGHJoomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4EPSS 0.4%CVE-2026-63264MEDIUMJoomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3EPSS 0.4%CVE-2026-78073MEDIUMJoomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0EPSS 0.4%CVE-2026-77989MEDIUMJoomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1EPSS 0.4%CVE-2026-76569MEDIUMJoomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4EPSS 0.4%