← CVE Radar
CVE-2026-76570Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
10.0 CRITICALEPSS 0.46%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 10.0 | CRITICAL | 4.0Joomla (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y |
| 9.1 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Details
- CVE ID
- CVE-2026-76570
- Status
- Analyzed
- Assigner (CNA)
- Joomla
- Published
- Sep 30, 2026
- Last modified
- 2026-10-06 17:19 UTC
- Weaknesses
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command
Affected Products
As published by the CNA in the CVE record.
joomcode.comJCTables extension for Joomla1 version range
- 1.0.0-1.20.0