EUVD-2026-17855Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Without CVSS vector data, EPSS score, or KEV status confirmation, precise severity assessment is constrained. However, SQL injection in a webservice endpoint typically presents critical risk due to direct database access. The vulnerability's location in a core content component and apparent lack of authentication barriers suggests broad attack surface. The absence of CVSS and patch information suggests either recent disclosure or ongoing analysis by the vendor. Organizations should treat this as high-priority until vendor patch guidance is released, given SQL injection's potential for data exfiltration, modification, or authentication bypass. |
| Exploit ScenarioDerived | An unauthenticated remote attacker crafts a malicious HTTP request to the articles webservice endpoint with a specially formatted ORDER BY clause containing SQL injection payload (for example, appending UNION SELECT or CASE statements to extract data from other database tables). The webservice processes the request without proper input validation, executing the injected SQL and returning sensitive data such as user credentials, configuration details, or arbitrary database content to the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
SQL injection in Joomla CMS articles webservice endpoint allows remote attackers to execute arbitrary SQL queries through improperly constructed ORDER BY clauses, affecting all versions of Joomla CMS. The vulnerability exists in the com_content component's webservice endpoint and permits unauthenticated query manipulation. No CVSS score or patch version information is available at time of analysis, limiting severity quantification.
RemediationAI
Consult the official Joomla Security Centre advisory at https://developer.joomla.org/security-centre/1028-20260302-core-sql-injection-in-com-content-articles-webservice-endpoint.html for vendor-released patch information and exact upgrade version. At time of analysis, no specific patched version is provided in available data. Interim mitigation may include disabling or restricting access to the com_content webservice endpoint if not required for production operations, and implementing Web Application Firewall rules to block SQL injection patterns in webservice requests. Apply patches immediately upon release from Joomla.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-89 (SQL Injection) in Joomla CMS's content component webservice handler, where user-supplied input is insufficiently sanitized before being incorporated into SQL ORDER BY clauses. The articles webservice endpoint fails to properly validate or escape sort parameters, allowing attackers to inject malicious SQL syntax. Joomla is a PHP-based content management system; the affected CPE (cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:*) indicates all versions across all branches are potentially impacted. The root cause is improper input validation in query construction rather than parameterized query use.
Know when Joomla Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
DescriptionCVE.org
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in CMS Security Vulnerabilities
View all 6More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-priv
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
MFA bypass in Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows an attacker who can drive the login flow to
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
GitHub PoC
Exploit-DB