CVE-2026-74804

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...

EUVD-2026-62430

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...

CVE-2026-74804 Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...

CVE-2026-74804 Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...

PT-2026-78367

Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated SQL injection exists in the element function of the ItemController. The issue occurs because the filter type request value and the type filter array are interpolated into the database...

CVE-2026-74804: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element in Zoo 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN "...", with no quoting or escaping...