This vulnerability is an SQL injection flaw in the search.php file of Joomla com_hdwplayer 4.2, triggered by the hdwplayersearch POST parameter. An attacker can supply arbitrary SQL code that is executed against the database, allowing extraction of sensitive data from the hdwplayer_videos table. No capability to modify or delete data is documented in the description.

The affected component is Hdwplayer's com_hdwplayer 4.2 within a Joomla installation. Only this specific release is listed as vulnerable; no other versions are noted.

The CVSS score of 8.8 places the flaw in the high severity range, reflecting significant potential data loss. The EPSS score is not available, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA's KEV catalog. Because the flaw is triggered by unauthenticated POST requests to search.php, the attack surface is publicly accessible. An attacker can manually construct a payload or use automated tools to extract database information.