← CVE Radar
CVE-2026-100752Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.
9.3 CRITICALEPSS 0.31%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.3 | CRITICAL | 4.0Joomla (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-100752
- Status
- Analyzed
- Assigner (CNA)
- Joomla
- Published
- Sep 28, 2026
- Last modified
- 2026-10-27 14:12 UTC
- Weaknesses
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
As published by the CNA in the CVE record.
ordasoft.comReal Estate Manager (Free) extension for Joomla1 version range
- 1.0.0-6.7.8