EUVD-2026-63937
GHSA-vmfm-wc5f-55m2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Contributor-level maps to PR:L not PR:H; full database CIA impact applies, no scope change as exploitation is contained to the vulnerable Joomla instance.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.
AnalysisAI
SQL injection in YOOtheme Pro for Joomla (versions 1.0.0-5.0.40) allows any authenticated contributor-level user to embed arbitrary SQL content into backend queries, potentially exposing or corrupting the entire Joomla site database including user credentials and content. The vulnerability spans the full release history of the extension through 5.0.40 and is particularly dangerous in multi-author or open-registration Joomla deployments where untrusted users hold contributor roles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid contributor-level (or higher) authenticated account on the target Joomla installation - an attacker cannot exploit this unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.6 reflects the severe database impact (VC:H/VI:H/VA:H), yet the practical exploitation probability is currently low: EPSS registers only 0.26% (18th percentile) and CISA SSVC confirms exploitation status as none with automatable classified as no, indicating targeted rather than mass-scale exploitation is expected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or acquires a contributor-level account on a Joomla site running YOOtheme Pro 1.0.0-5.0.40, then submits a crafted content request through the extension's contributor interface embedding SQL metacharacters that alter the underlying query. This allows the attacker to enumerate database tables, extract user credentials or sensitive content, or modify database records. … |
| Remediation | Upgrade YOOtheme Pro to a version released after 5.0.40; the exact patched release version is not confirmed in currently available intelligence sources, so administrators should consult the vendor directly at https://www.yootheme.com/ for the specific fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Joomla installations using YOOtheme Pro, confirm versions in use, and document the number of contributor-level users with access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, pri
Arbitrary file read in YOOtheme Pro (Joomla extension) versions 2.3.0 through 5.0.40 allows privileged authenticated use
Privileged information disclosure in YOOtheme Pro for Joomla (versions 1.0.0 through 5.0.41) allows authenticated users
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today