CVE-2026-76570CWE-89sql-injection

CVE-2026-76570

Critical · published September 30, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-30T19:22Z
Affected products (1)
ProductVersionsFixed in
joomcode/jc_tables< 1.21.11.21.1
References (2)
https://www.joomcode.com/ · [email protected]https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rce · [email protected]
EPSS history
Timeline
  • 02 OCT 03:46Z
    EPSS moved — → 1%
    epss
  • 30 SEP 14:47Z
    Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
    cvelistv5