Exposição de Joomla

CMS
1.616
score de exposição
84.613
sites usam
6
em exploração
108
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

560 resultados
CVE-2026-60031MEDIUMJoomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1EPSS 0.4%CVE-2026-64798CRITICALJoomla Extension - regularlabs.com - Insecure login URL keys in IP login extensionEPSS 0.4%CVE-2024-40748HIGH[20250102] - Core - XSS vector in the id attribute of menu listsEPSS 0.4%CVE-2024-21730MEDIUM[20240702] - Core - Self-XSS in fancyselect list field layoutEPSS 0.4%CVE-2026-64792HIGHJoomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensionsEPSS 0.4%CVE-2026-48957MEDIUMJoomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpointsEPSS 0.4%CVE-2026-48948MEDIUMJoomla! Core - [20260702] - Incorrect Access Control in com_contact vcf downloadEPSS 0.4%CVE-2025-50058MEDIUMExtension - rsjoomla.com - Stored XSS vulnerability in RSDirectory! component 1.16.3-1.17.7 for JoomlaEPSS 0.4%CVE-2026-97161CRITICALJoomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29EPSS 0.4%CVE-2026-94130CRITICALJoomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3EPSS 0.4%CVE-2026-65760CRITICALJoomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1EPSS 0.4%CVE-2026-74251CRITICALJoomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6EPSS 0.4%CVE-2026-76571CRITICALJoomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2EPSS 0.4%CVE-2026-63685HIGHJoomla Extension - regularlabs.com - Authorization bypass in DB Replacer extensionEPSS 0.4%CVE-2026-67283MEDIUMJoomla Extension - tabaoca.org - Improper ACL implementation allows allow file operations in Cotton Cloud < 2.0.2EPSS 0.4%CVE-2026-64794MEDIUMJoomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensionsEPSS 0.4%CVE-2026-67287MEDIUMJoomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0EPSS 0.4%CVE-2026-60034CRITICALJoomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0EPSS 0.4%CVE-2026-60028HIGHJoomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1EPSS 0.4%CVE-2026-78077HIGHJoomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11EPSS 0.4%