Exposição de Joomla

CMS
1.616
score de exposição
84.613
sites usam
6
em exploração
108
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

560 resultados
CVE-2023-34476—Extension - mooj.org - SQLi in Proforms Basic component for Joomla <= 1.6.0EPSS 0.6%CVE-2023-23758—Extension - creative-solutions.net - SQLi in Creative Gallery component for Joomla <= 2.2.0EPSS 0.6%CVE-2023-23757—Extension - bestaddon.com - SQLi in BA Gallery component for Joomla <= 1.2.0EPSS 0.6%CVE-2022-27911—[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'EPSS 0.6%CVE-2026-77998CRITICALJoomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4EPSS 0.6%CVE-2022-23798—[20220306] - Core - Inadequate validation of internal URLsEPSS 0.6%CVE-2026-102425CRITICALJoomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4EPSS 0.6%CVE-2022-23801—[20220309] - Core - XSS attack vector through SVGEPSS 0.6%CVE-2022-23796—[20220304] - Core - Missing input validation within com_fields class inputsEPSS 0.6%CVE-2026-61425CRITICALJoomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0EPSS 0.6%CVE-2026-49048HIGHJoomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1EPSS 0.6%CVE-2025-30085CRITICALExtension - rsjoomla.com - Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for JoomlaEPSS 0.6%CVE-2026-34424CRITICALSmart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access ToolkitEPSS 0.6%CVE-2023-23755HIGH[20230502] - Core - Bruteforce prevention within the mfa screenEPSS 0.6%CVE-2022-27914—[20221101] - Core - RXSS through reflection of user input in com_mediaEPSS 0.6%CVE-2026-66492MEDIUMJoomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3EPSS 0.6%CVE-2026-67363HIGHJoomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2EPSS 0.6%CVE-2026-65886CRITICALJoomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2EPSS 0.6%CVE-2026-78000MEDIUMJoomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.5%CVE-2024-32788MEDIUMWordPress FG Joomla to Wordpress plugin <= 4.20.2 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.5%