Exposição de Joomla

CMS
1.616
score de exposição
84.613
sites usam
6
em exploração
108
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

560 resultados
CVE-2026-57827CRITICALJoomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12EPSS 2.3%CVE-2022-23793—[20220301] - Core - Zip Slip within the Tar extractorEPSS 2.1%CVE-2011-1151—Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.EPSS 1.9%CVE-2023-28731CRITICALUnauthenticated RCE affecting the AcyMailing plugin for JoomlaEPSS 1.8%CVE-2013-3932—SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "BusineEPSS 1.8%CVE-2020-35612—[20201103] - Core - Path traversal in mod_random_imageEPSS 1.6%CVE-2011-4937—Joomla! 1.7.1 has core information disclosure due to inadequate error checking.EPSS 1.6%CVE-2026-66914CRITICALJoomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1EPSS 1.5%CVE-2026-56292CRITICALJoomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1EPSS 1.4%CVE-2021-23128—[20210302] - Core - Potential Insecure FOFEncryptRandvalEPSS 1.4%CVE-2021-23127—[20210301] - Core - Insecure randomness within 2FA secret generationEPSS 1.4%CVE-2021-23131—[20210305] - Core - Input validation within the template managerEPSS 1.4%CVE-2020-35610—[20201101] - Core - com_finder ignores access levels on autosuggestEPSS 1.4%CVE-2020-35611—[20201102] - Core - Disclosure of secrets in Global Configuration pageEPSS 1.3%CVE-2026-97160CRITICALJoomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29EPSS 1.3%CVE-2022-23799—[20220307] - Core - Variable Tampering on JInput $_REQUEST dataEPSS 1.2%CVE-2021-26036—[20210702] - Core - DoS through usergroup table manipulationEPSS 1.2%CVE-2021-23123—[20210101] - Core - com_modules exposes module namesEPSS 1.2%CVE-2017-2550—Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename.EPSS 1.2%CVE-2022-23795—[20220303] - Core - User row are not bound to a authentication mechanismEPSS 1.1%