CVE-2026-65877
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 contains an SQL injection vulnerability in the search and date filters of the media manager, allowing an authenticated user to manipulate database queries.
Risk Assessment
Risk of data leakage or modification in the database, potentially leading to information theft or site takeover.
Recommendation
Update SP Page Builder to version 6.7.1 or later, which fixes this vulnerability.
Other vulnerabilities in SP Page Builder
See all- CVE-2026-67285Critical
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated arbitrary local PHP file inclusion vulnerability. An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.
- CVE-2026-65879Critical
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1. The hardcoded secret allowed attackers to forge the mail from address of forms.
- CVE-2026-65876Critical
Joomla extension SP Page Builder before version 6.8.0 contains an unauthenticated SQL injection vulnerability. Improper validation of catid parameters in the loadMoreArticles endpoint allows an attacker to execute SQL queries.
- CVE-2026-65766Critical
The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the Dynamic Content endpoint due to improper validation of the order parameter.
- CVE-2026-48908CriticalActively exploited
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
- CVE-2026-67287Medium
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.
- CVE-2026-67286Medium
In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.
- CVE-2026-66494High
An unauthenticated stored XSS vulnerability in SP Page Builder (< 6.7.0) for Joomla allows an attacker to store malicious JavaScript in the site's database via a single HTTP request. When an administrator opens the editor, the script executes automatically.
- CVE-2026-65878High
The SP Page Builder extension for Joomla (from joomshaper.com) below version 6.7.1 allows an authenticated user to delete arbitrary files due to improper path validation and ACL checks in the media manager.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.