Youtube Gallery Extension For Joomla
Monthly
Unauthenticated SQL injection in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) lets remote attackers inject arbitrary SQL into read queries through the video search and sorting parameters of the public-facing gallery. No credentials, user interaction, or non-default configuration are required - only that the extension is installed and its video search/sorting front end is reachable, which is its normal deployment state. The CNA rates it 9.3 under CVSS 4.0, our independent assessment scores it as high severity with confidentiality impact dominant (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is bounded by deployment scope: core Joomla installations without this third-party extension are not affected, but any site that does run it is exposed to unauthenticated database disclosure.
Unauthenticated SQL injection in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) lets remote attackers inject arbitrary SQL into read queries through the video search and sorting parameters of the public-facing gallery. No credentials, user interaction, or non-default configuration are required - only that the extension is installed and its video search/sorting front end is reachable, which is its normal deployment state. The CNA rates it 9.3 under CVSS 4.0, our independent assessment scores it as high severity with confidentiality impact dominant (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is bounded by deployment scope: core Joomla installations without this third-party extension are not affected, but any site that does run it is exposed to unauthenticated database disclosure.