{"id":"CVE-2026-76570","published":"2026-09-30T15:22:34.903","lastModified":"2026-10-06T17:19:45.533","description":"Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables  1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-89"],"vendors":["joomcode"],"products":["jc tables"],"references":[{"url":"https://www.joomcode.com/","tags":["Product"]},{"url":"https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rce","tags":["Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is an unauthenticated SQL injection vulnerability in the Joomla Extension joomcode.com, specifically in the JCTables 1.21.1 version, allowing attackers to execute arbitrary SQL queries and potentially read or write data without proper authentication.","exploitability":"Exploitation is relatively easy due to the lack of Joomla token validation and authentication checks. An attacker needs to manipulate request parameters to inject SQL queries.","blast_radius":"If exploited, the vulnerability could lead to data theft or corruption, as the attacker can execute arbitrary SQL commands on the database.","remediation":"Upgrade to JCTables 2.590 or later, as the fixed version is mentioned in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","unauthenticated","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:44:06.731Z"}}