Exposición de Joomla

CMS
986
score de exposición
94.953
sitios usan
4
en explotación
58
críticos
Análisis Vexday

O Joomla acumula 223 CVEs catalogadas, com 24 classificadas como críticas e 49 surgidas apenas nos últimos 90 dias, indicando ritmo contínuo de descoberta de vulnerabilidades. A taxa de exploração ativa — 0,9% das CVEs presentes no catálogo CISA KEV — está 2× acima da média geral do catálogo, o que sugere que adversários demonstram interesse concreto em abusar de falhas nessa plataforma. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente difícil de erradicar em sistemas baseados em extensões de terceiros. A CVE mais perigosa em exploração ativa, CVE-2023-23752, carrega um score EPSS de 0,9983 — praticamente a probabilidade máxima de exploração —, tornando sua correção imediata uma prioridade inegociável para qualquer instância exposta.

CVEs

332 resultados
CVE-2025-25226CRITICAL[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database packageEPSS 0.5%CVE-2024-26279MEDIUM[20240704] - Core - XSS in Wrapper extensionsEPSS 0.5%CVE-2026-65880CRITICALJoomla Extension - joomshaper.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3EPSS 0.5%CVE-2022-27914—[20221101] - Core - RXSS through reflection of user input in com_mediaEPSS 0.5%CVE-2026-23898HIGHJoomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdateEPSS 0.5%CVE-2024-26278MEDIUM[20240705] - Core - XSS in com_fields default field valueEPSS 0.4%CVE-2026-40384MEDIUMJoomla! Core - [20260510] - Path traversal in com_media webservice endpointEPSS 0.4%CVE-2023-23751MEDIUM[20230102] - Core - Missing ACL checks for com_actionlogsEPSS 0.4%CVE-2024-21731MEDIUM[20240703] - Core - XSS in StringHelper::truncate methodEPSS 0.4%CVE-2024-21729MEDIUM[20240701] - Core - XSS in accessible media selection fieldEPSS 0.4%CVE-2024-27185CRITICAL[20240802] - Core - Cache Poisoning in PaginationEPSS 0.4%CVE-2025-22207MEDIUM[20250201] - Core - SQL injection vulnerability in Scheduled Tasks componentEPSS 0.4%CVE-2025-27445MEDIUMExtension - rsjoomla.com - A path traversal vulnerability RSFirewall component 2.9.7 - 3.1.5 for JoomlaEPSS 0.4%CVE-2024-21730MEDIUM[20240702] - Core - Self-XSS in fancyselect list field layoutEPSS 0.4%CVE-2023-39974—Extension - acymailing.com - Exposure of Sensitive Information in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.4%CVE-2025-49468HIGHJoomla Extension - nobossextensions.com - SQL injection vulnerability in No Boss Calendar component before 5.0.7 for JoomlaEPSS 0.4%CVE-2024-40748HIGH[20250102] - Core - XSS vector in the id attribute of menu listsEPSS 0.4%CVE-2017-20277HIGHJoomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_authorEPSS 0.4%CVE-2025-54298CRITICALExtension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for JoomlaEPSS 0.4%CVE-2025-54299CRITICALExtension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for JoomlaEPSS 0.4%