Exposição de Joomla

CMS
1.616
score de exposição
84.613
sites usam
6
em exploração
108
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

560 resultados
CVE-2011-3629—Joomla! core 1.7.1 allows information disclosure due to weak encryptionEPSS 1.1%CVE-2010-1433—Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-suEPSS 1.1%CVE-2021-23126—[20210301] - Core - Insecure randomness within 2FA secret generationEPSS 1.1%CVE-2022-23797—[20220305] - Core - Inadequate filtering on the selected IdsEPSS 1.1%CVE-2010-1435—Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions EPSS 1.1%CVE-2020-35614—[20201105] - Core - User Enumeration in backend loginEPSS 1.1%CVE-2023-39970—Extension - acymailing.com - RCE in AcyMailing component for Joomla 6.7.0-8.5.0EPSS 1.1%CVE-2021-26031—[20210402] - Core - Inadequate filters on module layout settingsEPSS 1.0%CVE-2026-65761CRITICALJoomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1EPSS 1.0%CVE-2010-1432—Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may EPSS 1.0%CVE-2021-26028—[20210308] - Core - Path Traversal within joomla/archive zip classEPSS 1.0%CVE-2021-26029—[20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author fieldEPSS 1.0%CVE-2021-26038—[20210704] - Core - Privilege escalation through com_installerEPSS 1.0%CVE-2026-49049HIGHJoomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handlerEPSS 1.0%CVE-2013-3931—Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users witEPSS 1.0%CVE-2021-26027—[20210307] - Core - ACL violation within com_content frontend editingEPSS 1.0%CVE-2010-1434—Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain accesEPSS 0.9%CVE-2021-26040—[20210801] - Core - Insufficient access control for com_media deletion endpointEPSS 0.9%CVE-2026-102427CRITICALJoomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16EPSS 0.9%CVE-2022-23794—[20220302] - Core - Path Disclosure within filesystem error messagesEPSS 0.9%