CVE-2026-77994

Name of the Vulnerable Software and Affected Versions Page Builder CK versions prior to 3.6.5

Description The Joomla extension Page Builder CK contains a second-order SQL injection flaw. This occurs when the loadStyles() function of the frontend page model constructs a query using previously stored data controlled by an attacker. When this stored value is subsequently loaded and concatenated into a SQL query, it allows for database read and modify operations, which could lead to administrative account takeover through the theft of sessions or credentials.

Recommendations Update to version 3.6.5.