Exposição de Joomla

CMS
1.616
score de exposição
84.613
sites usam
6
em exploração
108
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

560 resultados
CVE-2026-102782CRITICALJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0EPSS 0.9%CVE-2012-1562—Joomla! core before 2.5.3 allows unauthorized password change.EPSS 0.9%CVE-2011-4907—Joomla! 1.5x through 1.5.12: Missing JEXEC CheckEPSS 0.9%CVE-2021-26037—[20210703] - Core - Lack of enforced session terminationEPSS 0.9%CVE-2023-40629—Extension - king-products.net - SQLi vulnerability in LMS Lite component for Joomla 1.0.0-3.3.0.1EPSS 0.8%CVE-2023-49708—Extension - joomstar.com - SQLi vulnerability in Starshop component for Joomla 1.0.0-1.0.9EPSS 0.8%CVE-2023-49707—Extension - joomlart.com - SQLi vulnerability in S5 Register module for Joomla 1.0.0-3.0.0EPSS 0.8%CVE-2026-66915CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2EPSS 0.8%CVE-2011-3595—Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and auEPSS 0.8%CVE-2026-65883CRITICALJoomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0EPSS 0.8%CVE-2023-40626—[20231101] - Core - Exposure of environment variablesEPSS 0.8%CVE-2021-26032—[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUploadEPSS 0.8%CVE-2021-23130—[20210304] - Core - XSS within the feed parser libraryEPSS 0.8%CVE-2021-23129—[20210303] - Core - XSS within alert messages showed to usersEPSS 0.8%CVE-2023-23753CRITICALExtension - vi-solutions - Visforms Base Package for Joomla 3EPSS 0.8%CVE-2025-22204CRITICALExtension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for JoomlaEPSS 0.8%CVE-2026-67282CRITICALJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8EPSS 0.8%CVE-2026-102785CRITICALJoomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52EPSS 0.8%CVE-2026-65880CRITICALJoomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3EPSS 0.8%CVE-2011-4912—Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.EPSS 0.8%