CVE-2026-65766

CriticalCVSS 9.2

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of the order parameter.

Risk Assessment

An attacker could manipulate SQL queries, potentially leading to unauthorized data access or privilege escalation.

Recommendation

Update SP Page Builder to version 6.7.1 or later.

Original NVD description (English source)

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.