CVE-2026-76570 PUBLISHED

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

Assigner: Joomla
Reserved: 19.08.2026 Published: 30.09.2026 Updated: 30.09.2026

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y
CVSS Score: 10

Product Status

Vendor joomcode.com
Product JCTables extension for Joomla
Versions Default: unaffected
  • Version 1.0.0-1.20.0 is affected

Credits

  • Valentin Lobstein (Chocapikk) finder

References

Problem Types

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command CWE