Improperly constructed filter clauses in the com_finder search component allow an authenticated user to inject SQL statements. The resulting blind SQL injection (CWE-89) can be used to extract sensitive data from the database, leading to a breach of confidentiality. Because the attack is blind, the attacker must infer information from side‑channel responses such as response times or error messages. The vulnerability does not directly allow arbitrary code execution, but it does expose potentially critical data.

All Joomla! CMS installations that include the com_finder component are potentially affected. Specific affected versions are not listed in the advisory, so any site running the component with pre‑patch code is at risk.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is published, but the need for valid user credentials (authenticated) suggests moderate to low exploit probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker could exploit it by logging into the CMS with any user that has search access, sending injected queries through the search interface, and inferring data from timing or error responses.