← Back to the live CVE advisory feed

CVE-2026-78082: SP Property extension for Joomla

Severity

9.3 (CRITICAL)

Vendor

JOOMLA

Affected versions

1.0.0-4.1.3

Patch status

Unknown

Published

2026-09-10T10:17:31.863

Modified

2026-09-10T10:17:31.863

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Joomla Extension – joomshaper.com – Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 – The property search and listing query builders assembled several WHERE and ORDER BY clauses (zipcode, sorting, price_range_dropdown, and psize_range_dropdown) by directly concatenating raw request parameters into SQL strings without quoting or type casting. An unauthenticated remote attacker could execute boolean-based or time-based blind SQL injection to extract sensitive data from the database.

View the official NVD record for CVE-2026-78082

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.