CVSS 10.0 (critical) · published 2026-09-30
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
Affected products (NVD): joomcode jc_tables
Fixed in (NVD): 1.21.1
Weakness: CWE-89
Source: NVD CVE-2026-76570
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.