Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-88854: OrdaSoft Joomla Gallery lets anyone read database data
CVE-2026-88854 · published 1 day ago
Summary
The free OrdaSoft Joomla Gallery extension for Joomla (versions before 6.2.7) lets any visitor use the public search box to run their own database queries. Because the search input isn’t properly cleaned, an attacker can insert special commands and view information from the site’s database. Update the extension to version 6.2.7 or later, or remove the extension if you cannot upgrade.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ordasoft.com | ordasoft joomla gallery free extension for joomla | 1.0.0-6.2.6 |
| ordasoft.com | ordasoft joomla gallery extension for joomla | 1.0.0-6.2.6 |
Original advisory text
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: mod_osgallery_search is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content.
References
Severity
9.3
Critical
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-89SQL Injection
Timeline
Published20 Sep 2026
Updated21 Sep 2026
First seen20 Sep 2026
Track software like this
Free during beta