CVE-2026-65876CWE-89sql-injection

CVE-2026-65876

published July 27, 2026

CVSS

9.2

EPSS

Percentile

31.4

In the wild

Unconfirmed

What it is

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.

The record

Technical detail

CVSS: 9.2 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00386 · 31.4th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-07-27T18:17Z

References (1)

https://www.joomshaper.com/page-builder · [email protected]

EPSS history

Timeline

27 JUL 13:00Z
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1
cvelistv5