CVE-2026-78080

JooDatabase Lite, a Joomla extension by feenders.de, is vulnerable to unauthenticated SQL injection (CWE-89) in versions prior to 5.1.0. The extension passes the request's 'cid' parameter into SQL queries without validation, so an unauthenticated attacker can submit a crafted value for that parameter and have arbitrary SQL executed against the site's database. A successful attack can read, modify, or delete database content reachable by the component — potentially including sensitive Joomla data — with no privileges, authentication, or user interaction required. Any Joomla site running JooDatabase Lite below 5.1.0 and exposing the component's pages to anonymous visitors is affected. No public proof-of-concept or confirmed exploitation is known; EPSS assigns a 0.3% (20th percentile) probability of exploitation within the next 30 days.

What to do: Upgrade JooDatabase Lite to version 5.1.0 or later. As interim mitigations, restrict the component's pages from unauthenticated access, apply strict integer validation on the 'cid' parameter via a WAF rule, or temporarily disable the component. Review web server logs for anomalous 'cid' values and audit the Joomla database for unexpected changes or injected records.