Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 0.5%
from disclosure to weapon0 days
Published on NVDSep 30
1st PoCSep 30
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y
Affected products
joomcode.com · JCTables extension for Joomlapublic PoCs found — 1
githubgithub.com/murrez/CVE-2026-76570★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.