Sexy Polling Reloaded Extension For Joomla
Monthly
Unauthenticated blind SQL injection in the Sexy Polling Reloaded Joomla extension (Jefferson49) affects all versions below 5.6.1, enabling remote attackers to exfiltrate the entire underlying database without credentials. The CVSS 4.0 score of 8.7 reflects a trivial exploitation path - no authentication, no user interaction, and no configuration preconditions required against default installations of the extension. No public exploit code or CISA KEV listing has been identified at time of analysis, though the fully unauthenticated network vector makes opportunistic automated scanning a realistic threat vector.
Unauthenticated blind SQL injection in the Sexy Polling Reloaded Joomla extension (Jefferson49) affects all versions below 5.6.1, enabling remote attackers to exfiltrate the entire underlying database without credentials. The CVSS 4.0 score of 8.7 reflects a trivial exploitation path - no authentication, no user interaction, and no configuration preconditions required against default installations of the extension. No public exploit code or CISA KEV listing has been identified at time of analysis, though the fully unauthenticated network vector makes opportunistic automated scanning a realistic threat vector.