Exposição de Joomla

CMS
1.482
score de exposição
88.994
sites usam
4
em exploração
89
críticos
Análise Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

471 resultados
CVE-2026-66917HIGHJoomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0EPSS 0.5%CVE-2024-26279MEDIUM[20240704] - Core - XSS in Wrapper extensionsEPSS 0.5%CVE-2026-48958MEDIUMJoomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpointsEPSS 0.5%CVE-2026-65880CRITICALJoomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3EPSS 0.5%CVE-2026-23898HIGHJoomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdateEPSS 0.5%CVE-2025-22207MEDIUM[20250201] - Core - SQL injection vulnerability in Scheduled Tasks componentEPSS 0.4%CVE-2026-66492MEDIUMJoomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3EPSS 0.4%CVE-2024-26278MEDIUM[20240705] - Core - XSS in com_fields default field valueEPSS 0.4%CVE-2026-62415CRITICALJoomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2EPSS 0.4%CVE-2026-61424CRITICALJoomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2EPSS 0.4%CVE-2026-61900CRITICALJoomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6EPSS 0.4%CVE-2026-40384MEDIUMJoomla! Core - [20260510] - Path traversal in com_media webservice endpointEPSS 0.4%CVE-2023-23751MEDIUM[20230102] - Core - Missing ACL checks for com_actionlogsEPSS 0.4%CVE-2026-48944MEDIUMJoomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26EPSS 0.4%CVE-2024-21731MEDIUM[20240703] - Core - XSS in StringHelper::truncate methodEPSS 0.4%CVE-2024-21729MEDIUM[20240701] - Core - XSS in accessible media selection fieldEPSS 0.4%CVE-2024-27185CRITICAL[20240802] - Core - Cache Poisoning in PaginationEPSS 0.4%CVE-2025-27445MEDIUMExtension - rsjoomla.com - A path traversal vulnerability RSFirewall component 2.9.7 - 3.1.5 for JoomlaEPSS 0.4%CVE-2026-58148HIGHJoomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52EPSS 0.4%CVE-2026-58077HIGHJoomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2EPSS 0.4%