Vulnerability · Published May 13, 2026 · Assigned by VulnCheck

CVE-2020-37218Joomla com_hdwplayer 4.2 SQL Injection via search.php

High 8.2

In plain English

A high-severity SQL injection in com_hdwplayer from Hdwplayer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hdwplayersearch parameter. Attackers can submit POST requests with crafted SQL payloads in the hdwplayersearch parameter to extract sensitive database information from the hdwplayer_videos table.

Affected products (as reported)

Vendor	Product	Versions
Hdwplayer	com_hdwplayer	4.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

ExploitDB-48242 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: Joomla com_hdwplayer 4.2 SQL Injection via search.php third-party-advisory