Medium · 6.9 CVE-2026-35222 EUVD-2026-31887GHSA-pqh8-m9hh-m26w

Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags

Published May 26, 2026 · Updated Jun 5, 2026 · Assigned by Joomla

Description

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	6.0.0-6.1.0, 4.0.0-5.4.5	—