An SQL injection flaw exists in Joomla! when it builds ORDER BY clauses for the com_content articles webservice endpoint. This defect allows an attacker to inject arbitrary SQL statements, potentially enabling unauthorized read, modification, or deletion of database contents, and even denial of service. The weakness is a classic input validation failure (CWE‑89).

The vulnerability targets installations of Joomla! CMS that include the com_content articles webservice endpoint and have not applied the vendor’s latest security patch. No specific version numbers are listed, so all releases older than the fix are potentially exposed.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves accessing the articles webservice endpoint, possibly through authenticated or unauthenticated traffic; an attacker who reaches this endpoint can manipulate the ORDER BY clause to inject malicious SQL.