CVE-2026-76570
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
- State
- Published
- Severity
- 10.0 Critical
- Published
- Sep 30, 2026
- Updated
- Sep 30, 2026
- Reserved
- Aug 19, 2026
Description
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y | Joomla |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected Products
| Product | Versions |
|---|---|
JCTables extension for Joomlajoomcode.com |
|
References
- https://www.joomcode.com/product
- https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rcethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.