CVE-2026-49048: Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-28 · updated 2026-10-25
Weakness: CWE-89

Description

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

Affected products

joomcoder.com JoomCCK extension for Joomla: from 1.0 through 6.4.0

References

https://www.joomcoder.com/

Get alerted when CVE-2026-49048 or the next vulnerability affects your stack