CVE-2023-51810 is a SQL injection in StackIdeas EasyDiscuss 5.0.5, a discussion extension for Joomla. A crafted request to the search parameter in the Users module can expose sensitive information. The record rates it High at 7.5 and says 5.0.10 fixes it.
What's affected
EasyDiscuss 5.0.5 is named in the record, which also says the flaw is fixed in 5.0.10. The product entry covers the Joomla edition. Versions between 5.0.5 and 5.0.10 were not separately confirmed, so upgrade to 5.0.10 or later rather than relying on a narrow range.
The record gives a CVSS score of 7.5 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity none, and on availability none. The weakness class is CWE-89.
How to check if you're exposed
In the Joomla administrator, open Extensions, then Manage, and find EasyDiscuss. The version column shows what you run. If it is below 5.0.10, update.
Also look at your web server logs for requests to the Users module search that carry unusual characters or long strings, which can signal probing.
What to do now
- Check the EasyDiscuss version on every Joomla site you manage.
- Update to 5.0.10 or later from the vendor's download area.
- Take a database backup before updating.
- Review database account rights, and give the Joomla user only what it needs.
- Check logs for suspicious search requests, and rotate passwords if you suspect data was read.
Why it matters
SQL injection, CWE-89, lets user input change the database query. The record describes the search parameter in the Users module of the extension. The consequence is exposure of data that the query was never meant to return.
Forum software stores user names, email addresses and password hashes. A read only injection flaw can pull those out, and the vector shows that no account is needed.
Joomla extensions are updated separately from the core, so a site can be fully patched at the core and still carry this flaw. Keep an inventory of extensions and their versions.
Try it yourself
Follow a finding from detection to a tracked fix in a vulnerability management view.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
The record says 5.0.10.
Is login required?
No. The vector shows no privileges and no user interaction.
Sources
Last reviewed: 19 October 2026.
