EUVD-2026-70452
GHSA-7jxq-9qmx-rwmw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity SQLi (AV:N/AC:L/PR:N/UI:N) giving read/write/destroy access to the site database yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors.
AnalysisAI
SQL injection in the JooDatabase Lite extension for Joomla (by feenders.de) before version 5.1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the unvalidated cid parameter. Because the parameter is concatenated into database queries without sanitization or parameterization, an attacker can read, modify, or destroy backend data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the JooDatabase Lite extension (version below 5.1.0) is installed and enabled on a reachable Joomla site, and that the vulnerable endpoint accepting the cid parameter is exposed to the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a fully remote, unauthenticated, low-complexity attack with high confidentiality, integrity, and availability impact - a serious combination for an internet-facing CMS component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade JooDatabase Lite to version 5.1.0 or later, which is the first release listed as not affected; obtain the update from the vendor at https://joodb.feenders.de/ (a dedicated advisory was not provided, so verify the fixed build against the vendor changelog before deploying). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately verify whether JooDatabase Lite (by feenders.de) is installed in your Joomla environment by checking the Extension Manager; if present, disable it immediately and document the change for audit purposes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today