The RPC Responsive Portfolio component version 1.6.1 for Joomla! contains a classic SQL injection flaw. Attackers can supply malicious SQL code in the id parameter of a GET request to the component’s entry point. Because the input is not sanitized, the database engine executes the injected query, allowing unrestricted data extraction or manipulation. The flaw does not require any authentication, meaning anyone who can reach the vulnerable URL can exploit it.

The vulnerability is found in the Extro RPC "RPC Responsive Portfolio" component for Joomla!, specifically the 1.6.1 release. No other versions or vendors are listed in the CVE data.

With a CVSS score of 8.8 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the publicly documented exploitation vector via a simple HTTP GET request means remote attackers can reach it from the open internet. The lack of authentication or role checks further increases the risk, potentially exposing sensitive database contents to attackers.