Exposición de Joomla

CMS
986
score de exposición
94.953
sitios usan
4
en explotación
58
críticos
Análisis Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

332 resultados
CVE-2023-54357HIGHJoomla com_booking 2.4.9 Information Disclosure via Account EnumerationEPSS 0.5%CVE-2023-38044—Extension - hikashop.com - SQLi in HikaShop component for Joomla <= 4.7.2EPSS 0.5%CVE-2024-21723MEDIUM[20240202] - Core - Open redirect in installation applicationEPSS 0.5%CVE-2022-27912—[20221001] - Core - Debug Mode leaks full request payloads including passwordsEPSS 0.5%CVE-2022-27911—[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'EPSS 0.5%CVE-2024-21724MEDIUM[20240203] - Core - XSS in media selection fieldsEPSS 0.5%CVE-2024-21722MEDIUM[20240201] - Core - Insufficient session expiration in MFA management viewsEPSS 0.5%CVE-2026-49048HIGHJoomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1EPSS 0.5%CVE-2023-34477—Extension - braincert.com - SQLi in Virtual Classroom component for Joomla <= 1.6.0EPSS 0.5%CVE-2023-34476—Extension - mooj.org - SQLi in Proforms Basic component for Joomla <= 1.6.0EPSS 0.5%CVE-2023-23758—Extension - creative-solutions.net - SQLi in Creative Gallery component for Joomla <= 2.2.0EPSS 0.5%CVE-2023-23757—Extension - bestaddon.com - SQLi in BA Gallery component for Joomla <= 1.2.0EPSS 0.5%CVE-2025-22205HIGHExtension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for JoomlaEPSS 0.5%CVE-2026-40383HIGHJoomla! Core - [20260509] - LFI in HTMLView layout parameterEPSS 0.5%CVE-2021-26034—[20210503] - Core - CSRF in data download endpointsEPSS 0.5%CVE-2021-26033—[20210502] - Core - CSRF in AJAX reordering endpointEPSS 0.5%CVE-2024-40744CRITICALExtension - tassos.gr - Unrestricted file upload in Convert Forms component for Joomla < 4.4.8EPSS 0.5%CVE-2025-22210HIGHExtension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for JoomlaEPSS 0.5%CVE-2025-22213HIGH[20250301] - Core - Malicious file uploads via Media ManagerEPSS 0.5%CVE-2025-30085CRITICALExtension - rsjoomla.com - Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for JoomlaEPSS 0.5%