Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-77994 Joomla Extension - http://joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue r… https://www.cve.org/CVERecord?id=CVE-2026-77994
Post summary
The post discloses a second order SQL injection vulnerability affecting Joomla's Page Builder CK extension (vulnerable versions <3.6.5) and includes a link to the official CVE record.
🚨Critical - Page Builder CK Second-Order SQL Injection in loadStyles (CVE-2026-77994) Joomla extension Page Builder CK’s frontend page model loadStyles method builds a query using previously stored attacker-controlled data, enabling second-order SQL injection when the value is later loaded and concatenated into SQL. Impact: DB read/modify and potential admin takeover via credential/session theft. 👉Affected: Page Builder CK for Joomla < 3.6.5 | Upgrade to 3.6.5
Post summary
A critical second‑order SQL injection vulnerability (CVE‑2026‑77994) was disclosed in Page Builder CK for Joomla, with details on the attack vector and impact, and a suggested fix to upgrade to version 3.6.5.