Exposição de Joomla

CMS
1.482
score de exposição
88.994
sites usam
4
em exploração
89
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 resultados
CVE-2026-76601MEDIUMJoomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2EPSS 0.3%CVE-2026-75114MEDIUMJoomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64EPSS 0.3%CVE-2026-67364CRITICALJoomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2EPSS 0.3%CVE-2017-20279HIGHJoomla Payage 2.05 SQL Injection via aid ParameterEPSS 0.3%CVE-2026-76613HIGHJoomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40EPSS 0.3%CVE-2026-65885CRITICALJoomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2EPSS 0.3%CVE-2026-48904HIGHJoomla! Core - [20260514] - Privilege escalation through com_users webservice endpointsEPSS 0.3%CVE-2026-65888CRITICALJoomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2EPSS 0.3%CVE-2026-64874CRITICALJoomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extensionEPSS 0.3%CVE-2026-65889CRITICALJoomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2EPSS 0.3%CVE-2026-64796CRITICALJoomla Extension - regularlabs.com - various code injection vectors in Sourcerer extensionEPSS 0.3%CVE-2026-65884CRITICALJoomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2EPSS 0.3%CVE-2026-65879CRITICALJoomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1EPSS 0.3%CVE-2026-48946MEDIUMJoomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26EPSS 0.3%CVE-2026-48940LOWJoomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26EPSS 0.3%CVE-2026-65890CRITICALJoomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2EPSS 0.3%CVE-2026-74254CRITICALJoomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5EPSS 0.3%CVE-2026-78080CRITICALJoomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0EPSS 0.3%CVE-2026-74804CRITICALJoomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64EPSS 0.3%CVE-2026-75954CRITICALJoomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3EPSS 0.3%