CVE-2026-76570 — Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

CVE-2026-76570

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1 PUBLISHED

Description (CNA)

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

Affected (CNA)

Vendor / product	Versions
joomcode.com / JCTables extension for Joomla	affected 1.0.0-1.20.0

CWE

CWE-89

References

https://www.joomcode.com/
https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rce

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.