CVE-2026-49048
Description
The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.
Metadata
Severity & Metrics
No CVSS data available.
Affected products (1)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| joomcoder.com | JoomCCK extension for Joomla | — | 1.0-6.4.0 |
Weakness (CWE)
| CWE | Source | Description |
|---|---|---|
| CWE-89 | cna | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
References (1)