Exposição de Joomla

CMS
1.616
score de exposição
84.613
sites usam
6
em exploração
108
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

560 resultados
CVE-2026-60024CRITICALJoomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0EPSS 0.5%CVE-2026-57828CRITICALJoomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3EPSS 0.5%CVE-2026-78074HIGHJoomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensionsEPSS 0.5%CVE-2026-67362MEDIUMJoomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.5%CVE-2026-78374MEDIUMJoomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0EPSS 0.5%CVE-2024-21723MEDIUM[20240202] - Core - Open redirect in installation applicationEPSS 0.5%CVE-2026-60026HIGHJoomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1EPSS 0.5%CVE-2026-64874CRITICALJoomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extensionEPSS 0.5%CVE-2026-65885CRITICALJoomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2EPSS 0.5%CVE-2026-74252HIGHJoomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.5%CVE-2026-60027HIGHJoomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1EPSS 0.5%CVE-2026-66917HIGHJoomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0EPSS 0.5%CVE-2026-67286MEDIUMJoomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0EPSS 0.5%CVE-2026-65888CRITICALJoomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2EPSS 0.5%CVE-2026-65887CRITICALJoomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2EPSS 0.5%CVE-2026-65884CRITICALJoomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2EPSS 0.5%CVE-2026-40384MEDIUMJoomla! Core - [20260510] - Path traversal in com_media webservice endpointEPSS 0.5%CVE-2024-40744CRITICALExtension - tassos.gr - Unrestricted file upload in Convert Forms component for Joomla < 4.4.8EPSS 0.5%CVE-2025-22205HIGHExtension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for JoomlaEPSS 0.5%CVE-2024-21724MEDIUM[20240203] - Core - XSS in media selection fieldsEPSS 0.5%