← CVE Radar
CVE-2026-101108Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect.
9.3 CRITICALEPSS 0.31%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.3 | CRITICAL | 4.0Joomla (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-101108
- Status
- Analyzed
- Assigner (CNA)
- Joomla
- Published
- Sep 28, 2026
- Last modified
- 2026-10-27 13:59 UTC
- Weaknesses
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
As published by the CNA in the CVE record.
ordasoft.comVehicle Manager (Free) extension for Joomla1 version range
- 1.0.0-6.5.7