Critical severity · published Aug 19, 2026
CVE-2026-74804
Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zoo extension for Joomla · yootheme.com
1.0.0-4.1.63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74804
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-74804
www.yootheme.com
https://www.yootheme.com/
More from Zoo extension for Joomla
10.0
CVE-2026-74803
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64
8.6
CVE-2026-76612
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66
6.9
CVE-2026-76611
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66
6.9
CVE-2026-76610
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
5.3
CVE-2026-77028
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66