CVE-2020-37226 HIGH

CVE-2020-37226: Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby

Vendor Joomsky

Product J2 JOBS

Weakness CWE-89 · SQLi

Published May 13, 2026

Last update May 14, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

Description

Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'sortby' parameter. Attackers can send POST requests to the administrator index with malicious 'sortby' values to extract sensitive database information using automated tools.

Key dates

Disclosure timeline

May 13, 2026 CVE published

May 14, 2026 Record updated