CVE-2026-102428: ordasoft joomla_cck

CVSS 9.8 (critical) · published 2026-10-05

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

Affected products (NVD): ordasoft joomla_cck

Fixed in (NVD): 8.3.16

Weakness: CWE-89

Source: NVD CVE-2026-102428

References

• https://www.ordasoft.com/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.