CVE-2026-102428

CriticalCVSS 9.3

Published: 05/10/2026(UTC)Updated: 05/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Summary

The Joomla extension OrdaSoft CCK before version 8.3.16 contains an unauthenticated SQL injection vulnerability. The order column for records was user provided and not properly validated, leading to a SQL injection vector.

Risk Assessment

An unauthenticated attacker can manipulate SQL queries, potentially leading to unauthorized data access, modification, or database corruption.

Recommendation

Update the OrdaSoft CCK extension to version 8.3.16 or later, which includes a fix for input validation.

Other vulnerabilities in OrdaSoft Joomla CCK

CVE-2026-102427Critical
Joomla Extension - OrdaSoft Joomla CCK before 8.3.16 has unauthenticated remote code execution. The file site/uploader.php is reached through normal frontend routing (task=getContent), with no authentication or ACL check. The handler validates the uploaded file's content with a real magic-byte MIME check, but the extension allow-list is commented out. The saved file's extension is taken directly from the attacker-supplied filename with no validation, and the file is written to a path under the Joomla web root executed by PHP. An image/PHP polyglot passed the content check with a .php extension.

Original NVD description (English source)

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS