CVE-2026-78080: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joodb.feenders.de JooDatabase Lite extension for Joomla

CVE-2026-78080 is an SQL injection vulnerability (CWE-89) in the JooDatabase Lite extension for Joomla (versions 1.0 to 5.0.0). The 'cid' parameter is incorporated into SQL queries without proper sanitization, enabling unauthenticated attackers to execute arbitrary SQL commands. This can result in unauthorized data access or modification. The vulnerability is publicly known and assigned a critical CVSS 4.0 score of 9.3, indicating network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch currently available.

Successful exploitation allows unauthenticated attackers to perform SQL injection attacks, potentially leading to unauthorized disclosure, modification, or deletion of database information. This compromises the confidentiality, integrity, and availability of the affected Joomla extension's data. The critical CVSS score reflects the severity and ease of exploitation without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable extension or restricting access to it as a temporary mitigation. Avoid exposing the vulnerable parameter to untrusted inputs. Monitor official channels for updates from the vendor regarding patches or workarounds.