Medium · 6.9 CVE-2026-35221 EUVD-2026-31892GHSA-9j3h-xqx2-rj7v

Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder

Published May 26, 2026 · Updated May 27, 2026 · Assigned by Joomla

Description

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	6.0.0-6.1.0, 5.4.0-5.4.5	—