EUVD-2026-64750
GHSA-mqwq-c23w-58cg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated frontend method (AV:N/PR:N/UI:N); SQLi yields full read/write to the CMS database (C:H/I:H/A:H); second-order staging noted but kept AC:L per available evidence.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model.
AnalysisAI
SQL injection in Page Builder CK, a Joomla site-building extension by joomlack.fr, affects all versions prior to 3.6.5 and allows remote attackers to inject arbitrary SQL through the loadStyles method of the frontend page model. Because it is a second-order flaw, malicious input is stored first and executed during a later database operation, ultimately exposing the full Joomla database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets Joomla sites running Page Builder CK before version 3.6.5 where the extension's frontend page rendering (the page model's loadStyles method) is reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuinely high-priority issue rather than an inflated CVSS number: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA all High) describes a network-reachable, unauthenticated, low-complexity flaw with full impact to the backing database, and CWE-89 on a frontend-reachable method is a well-understood, reliably exploitable class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits crafted input to a Page Builder CK frontend feature so that a malicious SQL fragment is stored by the application. When the frontend page model's loadStyles method later reads and processes that stored value, the fragment is concatenated into a database query and executed, letting the attacker read, modify, or destroy Joomla database contents such as user credentials and session data. … |
| Remediation | Upgrade Page Builder CK to version 3.6.5 or later, which is the release boundary indicated as fixed in the CVE description; treat 3.6.5 as the vendor-released patched version and verify the exact build against the vendor before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Joomla installations using Page Builder CK and isolate or disable the extension on non-critical systems; establish enhanced monitoring on database and web access logs for suspicious SQL queries and injection attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today