What’s Vulnerable › Vulnerabilities

CVE-2026-76570: Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-10-06
• Weakness: CWE-89

Description

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

Affected products

• joomcode.com JCTables extension for Joomla: before 1.21.1 — fixed in 1.21.1

How to fix

Upgrade to a fixed version: joomcode.com JCTables extension for Joomla 1.21.1. Check the vendor advisory for mitigations.

References

• https://www.joomcode.com/
• https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rce

Get alerted when CVE-2026-76570 or the next vulnerability affects your stack