The Joomla extension YouTube Gallery (by joomlaboat.com) has an unauthenticated SQL injection flaw in its video search and sorting functionality, identified as CWE-89. By supplying crafted input, an attacker can inject arbitrary SQL commands into read queries, potentially exposing sensitive data or altering database state. This vulnerability directly compromises database confidentiality and integrity.

This flaw affects installations of joomlaboat.com's YouTube Gallery extension older than version 5.7.3. Systems running any earlier release of the extension with the video search or sorting features enabled are at risk.

The CVSS score of 9.3 indicates a high severity, and the vulnerability is exploitable from the web without authentication. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the lack of an authentication barrier suggests ready‑to‑attack conditions. The vulnerability is not listed in CISA’s KEV catalog, but the combination of high impact and ease of exploitation warrants prompt action.