EUVD-2026-49200
GHSA-5r72-7rv9-rf42
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.
AnalysisAI
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to extract sensitive database contents via the loadMoreArticles endpoint. The vulnerability stems from improper validation of the catid parameter, which can be manipulated to execute arbitrary SQL queries. No public exploit or active exploitation has been reported at this time.
Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in al
Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract se
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joo
SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with
Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits r
Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypa
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today