SQL injection exists in the jdownloads 3.2.63 component for Joomla! via components/com_jdownloads/helpers/categories.php, order function via the filter_order parameter.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19455
Reference (s):
- http://www.cnvd.org.cn/flaw/show/CNVD-2019-09868