Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

OrdaSoft Joomla CCK lets attackers run database commands

CVE-2026-102428 · published 13 days ago
Summary

The OrdaSoft Joomla CCK extension (versions before 8.3.16) accepts a user‑provided order value without checking it. This lets a remote attacker add their own instructions to the website’s database, potentially reading or changing data. Update the extension to version 8.3.16 or later, or apply input‑validation patches, to close the risk.

What to do
  • Update ordasoft joomla_cck to version 8.3.16 or later.
Affected software
VendorProductAffected versions
ordasoft.com ordasoft joomla cck 1.0.0-8.3.15
ordasoft joomla_cck < 8.3.16
cpe:2.3:a:ordasoft:joomla_cck:*:*:*:*:*:joomla\!:*:*
Original advisory text
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-102428 · NVD
CVE-2026-102428 · MITRE
Track software like this
Free during beta