Joomla Cck vulnerabilities

2 known vulnerabilities in Joomla Cck from Ordasoft. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  OrdaSoft Joomla CCK: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-102428Oct 5, 2026OrdaSoft.com

  Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

• 10.0 Critical severity

  OrdaSoft Joomla CCK: Unrestricted Upload of File with Dangerous Type

  CVE-2026-102427Sep 30, 2026OrdaSoft.com

  Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the