CVE-2026-74804
Received Received - Intake

Unauthenticated SQL Injection in Joomla Zoo Extension

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Joomla! Project

Description
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-74804
EUVD
EUVD-2026-62430

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
yootheme zoo to 4.1.64 (exc)
yootheme yootheme_pro to 4.1.64 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in the Joomla extension Zoo (versions before 4.1.64). The flaw exists in the ItemController::element() function where user-supplied input in the filter_type parameter is directly interpolated into SQL queries without proper escaping or quoting. This allows attackers to manipulate database queries, potentially accessing or modifying sensitive data.

Detection Guidance

This vulnerability involves unauthenticated SQL injection in Joomla's Zoo extension (versions < 4.1.64). To detect it, inspect HTTP requests targeting the ItemController::element() endpoint for suspicious filter_type parameters. Check logs for queries containing unquoted type values or type_filter arrays with raw user input.

Impact Analysis

An attacker could exploit this to extract, alter, or delete database contents without authentication. This may lead to complete system compromise, unauthorized data access, or website defacement. The high CVSS score (9.3) indicates severe potential impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations, regulatory fines, and reputational damage.

Mitigation Strategies

Immediately update the Zoo extension to version 4.1.64 or later. If updating is not possible, disable the affected component or restrict access to the ItemController::element() endpoint via firewall rules. Review database logs for signs of exploitation and consider resetting database credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart