Exposição de Joomla

CMS
1.482
score de exposição
88.994
sites usam
4
em exploração
89
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 resultados
CVE-2011-3595—Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and auEPSS 0.8%CVE-2023-40626—[20231101] - Core - Exposure of environment variablesEPSS 0.8%CVE-2021-26032—[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUploadEPSS 0.8%CVE-2023-23753CRITICALExtension - vi-solutions - Visforms Base Package for Joomla 3EPSS 0.8%CVE-2025-22204CRITICALExtension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for JoomlaEPSS 0.8%CVE-2021-23130—[20210304] - Core - XSS within the feed parser libraryEPSS 0.8%CVE-2021-23129—[20210303] - Core - XSS within alert messages showed to usersEPSS 0.8%CVE-2011-4912—Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.EPSS 0.8%CVE-2021-23125—[20210103] - Core - XSS in com_tags image parametersEPSS 0.8%CVE-2021-26039—[20210705] - Core - XSS in com_media imagelistEPSS 0.7%CVE-2021-26035—[20210701] - Core - XSS in JForm Rules fieldEPSS 0.7%CVE-2026-65883CRITICALJoomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0EPSS 0.7%CVE-2023-40630CRITICALExtension - joomcode.com - Unauthenticated LFI/SSRF in JCDashboards component for Joomla 1.0.0-1.1.30EPSS 0.7%CVE-2022-23800—[20220308] - Core - Inadequate content filtering within the filter codeEPSS 0.7%CVE-2016-15016MEDIUMmrtnmtth joomla_mod_einsatz_stats helper.php getStatsByType sql injectionEPSS 0.7%CVE-2025-22208MEDIUMExtension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for JoomlaEPSS 0.7%CVE-2023-38044—Extension - hikashop.com - SQLi in HikaShop component for Joomla <= 4.7.2EPSS 0.6%CVE-2023-28732MEDIUMMissing access control affecting the AcyMailing plugin for JoomlaEPSS 0.6%CVE-2026-66915CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2EPSS 0.6%CVE-2023-34477—Extension - braincert.com - SQLi in Virtual Classroom component for Joomla <= 1.6.0EPSS 0.6%