SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-74804

CRITICAL · CVSS 9.3 EPSS 0.28%

Source: NVD + CISA KEV + EPSS · Published 2026-08-19 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

An unauthenticated SQL injection vulnerability exists in the ItemController::element() function of the Zoo extension for Joomla, affecting versions prior to 4.1.64. This flaw allows attackers to manipulate the filter_type request value, potentially leading to unauthorized access to sensitive data within the database. Joomla administrators and developers using the Zoo extension should prioritize patching this vulnerability to mitigate the risk of exploitation.

CVE
CVE-2026-74804
Severity
CRITICAL
CVSS
9.3
EPSS
0.28%

Original NVD Description

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.