Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site

SP Property Finder security vulnerabilities

mySites.guru tracks 1 vulnerability in SP Property Finder (com_spproperty), covering 6 CVEs. Every connected Joomla site is checked against it on each audit.

Is my site affected?

Your site is affected if it runs SP Property Finder in this range:

  • before 4.1.4
Latest safe version
4.1.4 or later. No rule we check matches that release or any newer one.
What to do
Update SP Property Finder to 4.1.4 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every SP Property Finder vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-78082CVSS 9.3CVE-2026-78303CVSS 6.9CVE-2026-78083CVSS 7.1CVE-2026-78084CVSS 6.9CVE-2026-78302CVSS 8.6CVE-2026-78085CVSS 6.9before 4.1.44.1.4Critical2026-09-10

What we check for

CriticalCVE-2026-78082CVE-2026-78303CVE-2026-78083CVE-2026-78084CVE-2026-78302CVE-2026-780852026-09-10

SP Property Finder (com_spproperty) below 4.1.4 - Unauthenticated SQL Injection (full database read) and Mail Relay

SP Property Finder below 4.1.4 contains an unauthenticated blind SQL injection in the public property search and map views, found by mySites.guru and reported privately to JoomShaper on 10 August 2026. Several search filters (the postcode, the sort control, and the price and size range dropdowns) are placed straight into the database query with no quoting, so an anonymous visitor with no login and no token can read any table in the Joomla database, password hashes and the site secret included. The injection is read-only, but reading the session table lets an attacker steal a logged-in administrator's session and take over the site from there, so treat it as serious. A second, lower-severity issue let the property contact and enquiry forms send email to any recipient with a spoofed sender (an unauthenticated mail relay). JoomShaper fixed both in SP Property Finder 4.1.4, released on 10 September 2026, which quotes and casts every filter value, validates the sort control against an allow-list, and derives the mail recipient from a database lookup instead of the request. mySites.guru verified the fix against the build JoomShaper shipped as 4.1.4. The same release also fixed further issues that mySites.guru did not report, tracked as CVE-2026-78084, CVE-2026-78302 and CVE-2026-78303. The reporter's two findings are CVE-2026-78082 (the SQL injection, published by the Joomla CNA at 9.3 Critical and credited to Phil Taylor of mySites.guru) and CVE-2026-78303 (the mail relay). The release also fixed CVE-2026-78083, CVE-2026-78084 and CVE-2026-78302, which mySites.guru did not report. All five CVE records were published at MITRE on 10 September 2026. Update to SP Property Finder 4.1.4 or later from JoomShaper. Updating closes the flaw but does not undo any database read that already happened: if a vulnerable version was public for a while, treat the password hashes and the site secret as potentially known.

Affected versions: < 4.1.4

Full advisory: our disclosure post

Timeline

  1. 10 September 2026Check added for CVE-2026-78082, CVE-2026-78303, CVE-2026-78083, CVE-2026-78084, CVE-2026-78302 and CVE-2026-78085 (before 4.1.4)
  2. 10 September 2026CVE-2026-78082 record published
  3. 10 September 2026CVE-2026-78303 record published
  4. 10 September 2026CVE-2026-78083 record published
  5. 10 September 2026CVE-2026-78084 record published
  6. 10 September 2026CVE-2026-78302 record published
  7. 10 September 2026CVE-2026-78085 record published
  8. 10 September 2026We published: Unauthenticated SQL Injection in SP Property Finder found by mySites.guru

What we have written about SP Property Finder

Unauthenticated SQL Injection in SP Property Finder found by mySites.guru

Unauthenticated SQL Injection in SP Property Finder found by mySites.guru

mySites.guru found an unauthenticated blind SQL injection in JoomShaper's SP Property Finder. Any visitor could read the database. Fixed in 4.1.4.

References

Each CVE page above links its official cve.org record and its NVD entry.

SP Property Finder vulnerability questions

Which versions of SP Property Finder are vulnerable?
mySites.guru tracks one vulnerability in SP Property Finder (com_spproperty). A site is affected if its installed version is in this range: before 4.1.4.
What is the latest safe version of SP Property Finder?
4.1.4. Every vulnerability tracked here is fixed by 4.1.4, and no rule we check matches that release or any later one.
How do I check which version of SP Property Finder my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_spproperty. mySites.guru reads the installed version on every audit of a connected site and checks it against this rule.

Running SP Property Finder on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-78082, CVE-2026-78303, CVE-2026-78083, CVE-2026-78084, CVE-2026-78302, CVE-2026-78085. Rules current as of 22 October 2026.