CVE-2026-74804

CriticalCVSS 9.3

Published: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64. The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

Risk Assessment

An attacker can execute arbitrary SQL queries, potentially leading to data confidentiality breaches, modification, or deletion in the database.

Recommendation

Upgrade the Zoo extension to version 4.1.64 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.