EUVD-2026-75393
GHSA-mj2w-425j-5pwf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable blind SQLi enables full data extraction (C:H); description indicates read-only extraction, so I:N/A:N rather than the vendor's VI:H/VA:H.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses (zipcode, sorting, price_range_dropdown, and psize_range_dropdown) by directly concatenating raw request parameters into SQL strings without quoting or type casting. An unauthenticated remote attacker could execute boolean-based or time-based blind SQL injection to extract sensitive data from the database.
AnalysisAI
Unauthenticated SQL injection in JoomShaper's SP Property extension for Joomla (versions before 4.1.4) lets remote attackers inject SQL through the property search and map-filtering query builders. The zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, enabling boolean- and time-based blind extraction of database contents. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a Joomla site run SP Property before version 4.1.4 with the public-facing property search and/or map-filtering features in use - no authentication, user interaction, or special privileges are needed (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS: the combination of network reachability, low complexity, and no authentication (AV:N/AC:L/PR:N/UI:N) means any internet-exposed Joomla site running a vulnerable SP Property version can be probed directly, and SQL injection against a CMS database typically exposes user records, session data, and configuration secrets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade SP Property to version 4.1.4 or later, which is the first fixed release (all prior versions are affected). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Joomla instances using JoomShaper SP Property extension and confirm deployed version through administration dashboard; for versions before 4.1.4, immediately restrict public access to property search and map-filtering functionality (affecting zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters) via Web Application Firewall rules, network segmentation, or runtime disabling. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
SQL injection vulnerability in Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public explo
SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!. Rated
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!. Rated
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.p
SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low
administrator/components/com_media/helpers/media.php in the media manager in Joomla!. Rated medium severity (CVSS 6.8),
Akeeba Restore (restore.php), as used in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low
Same weakness CWE-89 – SQL Injection
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today