Skip to main content

YOOtheme Zoo CVE-2026-74804

| EUVDEUVD-2026-62430 CRITICAL
SQL Injection (CWE-89)
2026-08-19 Joomla GHSA-v9gw-jh22-6wqh
SQLi Zoo Extension For Joomla
9.3
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Unauthenticated remote SQL injection via request parameters gives AV:N/AC:L/PR:N/UI:N; direct database access yields high confidentiality and integrity, with availability impact possible via destructive queries.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 14:18 vuln.today
CVE Published
Aug 19, 2026 - 13:35 cve.org
CRITICAL 9.3

DescriptionCVE.org

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

AnalysisAI

SQL injection in the YOOtheme Zoo content-construction extension for Joomla allows unauthenticated remote attackers to inject arbitrary SQL through the filter_type and type_filter request parameters, which are concatenated directly into a.type comparison clauses in ItemController::element() without quoting or escaping. All Zoo versions before 4.1.64 are affected, and because no authentication or user interaction is required, an attacker can read or manipulate the Joomla database over the network. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify Joomla site running Zoo < 4.1.64
Delivery
Craft request with malicious filter_type/type_filter value
Exploit
Break out of a.type string comparison
Execution
Inject UNION/blind SQL subquery
Impact
Extract or manipulate database contents
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only that the target Joomla site has the YOOtheme Zoo extension (version < 4.1.64) installed and that the vulnerable item element endpoint handling filter_type / type_filter is reachable - the default deployment for any Zoo-powered content view. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a crafted HTTP request to a Joomla site running Zoo, setting the filter_type (or type_filter[]) parameter to a payload that breaks out of the a.type = "..." string and appends a UNION-based or boolean/time-based subquery. With no authentication or user interaction required, the response (or timing) leaks database contents such as Joomla user tables and session data, and the attacker automates extraction across all reachable sites. …
Remediation Upgrade the Zoo extension to version 4.1.64 or later, which is the fixed release (the advisory scope is 'Zoo < 4.1.64'); this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete audit of your Joomla deployments to identify all systems running YOOtheme Zoo and document their version numbers. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Zoo Extension For Joomla

View all
CVE-2026-74803 CRITICAL
10.0 Aug 19

Unauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64)

CVE-2026-76612 HIGH
8.6 Aug 21

Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attac
CVE-2026-76611 MEDIUM
6.9 Aug 21

Unauthenticated arbitrary directory listing in the Gallery element of the YOOtheme Zoo extension for Joomla exposes serv
CVE-2026-77028 MEDIUM
5.3 Aug 21

Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attac
CVE-2026-75114 MEDIUM
5.1 Aug 19

Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers t

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-74804 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy