cyfenced.com →

[ CVE-2026-76570 · Published 30 Sep 2026 ]

Vulnerability in joomcode.com JCTables extension for Joomla

CVSS 9.1 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.1

[ Description ]Official description

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References