The identified flaw is a classic SQL injection vulnerability in the FocalPoint Pro / Free component for Joomla!; by injecting malicious code into the id request parameter, an attacker can execute arbitrary SQL queries against the underlying database. This permits the extraction of sensitive data. The weakness is classified as SQL injection (CWE‑89), enabling confidentiality violations and potential integrity damage.

The vulnerable component is FocalPoint Pro / Free version 1.2.3 developed by Focalpointx. Any Joomla! site deploying that version of the component is impacted; the entry point is the index.php script accessed with option=com_focalpoint, view=location and an id parameter.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score is not available, so the exact exploitation probability is unknown, but the lack of a KEV listing indicates no widespread exploitation at present. The likely attack vector is unauthenticated HTTP GET requests to the component, meaning any user reaching the site can attempt the injection.