CVE Catalog
CVE-2026-75954
CriticalCVSS 9.3Summary
SQL injection vulnerability in Joomla extension J-BusinessDirectory (cmsjunkie.com) before version 6.2.3. In trips search, search keywords and ORDER BY were concatenated into SQL. Version 6.2.3 quotes keywords and allow-lists the sort clause.
Risk Assessment
An attacker can inject malicious SQL code, potentially leading to unauthorized database access, data modification, or deletion.
Recommendation
Update J-BusinessDirectory to version 6.2.3 or later.
Original NVD description (English source)
Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause.