CVE-2026-102427
CriticalCVSS 10.0Summary
Joomla Extension - OrdaSoft Joomla CCK before 8.3.16 has unauthenticated remote code execution. The file site/uploader.php is reached through normal frontend routing (task=getContent), with no authentication or ACL check. The handler validates the uploaded file's content with a real magic-byte MIME check, but the extension allow-list is commented out. The saved file's extension is taken directly from the attacker-supplied filename with no validation, and the file is written to a path under the Joomla web root executed by PHP. An image/PHP polyglot passed the content check with a .php extension.
Risk Assessment
An unauthenticated attacker can execute arbitrary PHP code on the server, potentially leading to full compromise of the site and server, data theft, and further attacks.
Recommendation
Upgrade OrdaSoft Joomla CCK to version 8.3.16 or later. Immediately check for compromise and remove unauthorized files.
Related vulnerabilities
- CVE-2026-75969Critical
A missing authentication vulnerability in the firmware update mechanism of PTZOptics cameras and the Firmware Upgrade Tool allows an unauthenticated user to install modified firmware without administrator credentials. This affects many camera models and all versions of the Upgrade Tool.
- CVE-2026-62308Critical
In Tugtainer prior to version 1.30.6, an authenticated user can make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostnames, localhost, private IP ranges, or cloud metadata addresses. This can be abused as an authenticated blind SSRF.
- CVE-2026-55494Critical
In Tugtainer Agent prior to version 1.30.4, when AGENT_SECRET is not configured, Docker management APIs are accessible without authentication. The signature verification function in agent/auth.py returns success if Config.AGENT_SECRET is empty, making protected APIs accessible without authentication.
- CVE-2026-55181Critical
In Tugtainer prior to version 1.30.3, OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled, but a direct request to /auth/oidc/login still starts the OIDC login flow, returns HTTP 302, sets an oidc_state cookie, and redirects to the OIDC authorization endpoint. This bypasses the intended OIDC disable switch.
- CVE-2026-55176Critical
In Soft Machine versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth() and authenticateWorkspaceHttp() — accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying which workspace the caller belongs to. Because that secret is set identically on every container in the Fly app and is reachable from the user-facing process environment, any tenant can use it to authenticate to any other tenant's workspace API. This results in cross-workspace read, write, and destructive-restore primitives.
- CVE-2026-19445Critical
A remote, unauthenticated TLS client can crash a server or trigger a use-after-free if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
- CVE-2026-102490Critical
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
- CVE-2026-102489Critical
Zammad versions 6.3.0 to 6.5.4 are vulnerable to a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
- CVE-2026-103470Critical
In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.
- CVE-2026-76570Critical
Joomla Extension - JCTables 1.21.1 has unauthenticated SQL injection in read and write queries. The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
Original NVD description (English source)
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS