Ordasoft vulnerabilities
We track 5 vulnerabilities in Ordasoft products across 4 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 5, 2026.
Latest Ordasoft vulnerabilities
- 9.8 Critical severity
OrdaSoft Joomla CCK: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
- 10.0 Critical severity
OrdaSoft Joomla CCK: Unrestricted Upload of File with Dangerous Type
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the
- 9.8 Critical severity
Book Library (Free) extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(),
- 9.8 Critical severity
Vehicle Manager (Free) extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing,
- 9.8 Critical severity
Real Estate Manager (Free) extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full p