Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
CVSS v3.1 Score
9.1
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Information
- Published
- 30 sept. 2026
- Updated
- 6 oct. 2026
- Status
- Analyzed
- Source
- security@joomla.org
Affected products
joomcode jc tables
Versions : 1.21.1
Weaknesses (CWE)
CWE-89
References (2)
- https://www.joomcode.com/Product
- https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rceThird Party Advisory
Similar CVEs
Other vulnerabilities of type CWE-89
Loading…
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.