CVE-2026-58078

HighCVSS 8.7

Published: 16/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

The Joomla extension Quix Page Builder Pro versions below 6.2.1 is vulnerable to unauthenticated SQL injection. An attacker can send crafted queries without authentication.

Risk Assessment

An unauthenticated attacker can read, modify, or delete database data, leading to a breach of data confidentiality and integrity.

Recommendation

Update the Quix Page Builder Pro extension to version 6.2.1 or later.

Other vulnerabilities in Quix Page Builder Pro

CVE-2026-60026High
The Joomla extension Quix Page Builder Pro below version 6.2.1 allows an authenticated user with core.create/core.edit permissions to inject PHP code into element content. This code is executed via the include() function when the view is cached (caching is enabled by default).

Original NVD description (English source)

Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection.