CVE-2018-6376: Joomla!

Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days.

In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message.

Affected products

• Joomla! Joomla!: before 3.8.4 (fixed in 3.8.4)

Published 2018-01-30. Last modified 2026-06-17.