CVE-2026-102428
Ordasoft Joomla Cck: SQL injection
- Risk score
- 69/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
- Affected
- Ordasoft Joomla Cck
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Ordasoft Joomla Cck: Red, act today. Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s …
The flaws
- CVE-2026-102428: SQL injection (CVSS 9.8 · EPSS 0%)
- CVE-2026-102427: Unrestricted file upload can lead to remote code execution (CVSS 10.0 · EPSS 1%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Ordasoft Joomla Cck
Where it stands
- No known exploitation
Connects to
- Same weakness: SQL injection (CWE-89). 399 other warnings in 30 days
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
Last activity 5 Oct 2026. Patch Forecast updates every hour.