EUVD-2026-60304
GHSA-2r8h-jv53-973m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote frontend SQLi (AV:N/AC:L/PR:N/UI:N) grants full read/write to the site database, so C/I/A all High; scope unchanged as impact stays within the DB.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend.
AnalysisAI
SQL injection in Page Builder CK for Joomla (versions before 3.6.5) lets attackers manipulate database queries through the extension's styles model, exposing the underlying database to unauthorized read and write. The flaw is exploitable remotely without authentication per the CVSS 4.0 vector (AV:N/PR:N/UI:N), with the frontend attack surface closed in 3.6.4 and the backend surface closed in 3.6.5. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation of the primary (frontend) vector requires only that a Joomla site run Page Builder CK below version 3.6.4 and expose a page/endpoint that invokes the vulnerable styles model - no authentication, user interaction, or non-default configuration is needed for that path (AV:N/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuine high priority rather than an inflated score: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes remote, unauthenticated, low-complexity exploitation with full impact to the vulnerable database, consistent with a frontend-reachable SQLi in the 3.6.4-affected path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to a public Joomla page rendered by Page Builder CK, injecting SQL through a parameter that reaches the styles model. The manipulated query returns or modifies database contents, letting the attacker extract administrator password hashes or session data and pivot toward full site takeover. … |
| Remediation | Upgrade Page Builder CK to version 3.6.5, which fixes both the frontend and backend SQL injection vectors; note that 3.6.4 only closes the unauthenticated frontend path and leaves the backend vector open, so it is not a sufficient stopping point. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive inventory of all Joomla installations to identify systems running Page Builder CK versions prior to 3.6.5, and assess business criticality of each deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today