CVE Intelligence
Analysis AI-assisted

CVE-2026-49048: Joomcoder JoomCCK SQL Injection in Front-End Controller Task

CVE-2026-49048 affects the JoomCCK extension for Joomla from Joomcoder, where a front-end controller task concatenates a user-supplied request parameter into two SQL statements without escaping or parameterisation. The CNA reports a CVSS 3.1 base score of 9.8 (critical) and a 4.0 score of 8.7. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

JoomCCK is a Joomla extension from Joomcoder. According to the record, a front-end controller task builds two SQL statements by placing a user-supplied request parameter directly into the query text, without escaping or parameterisation. This matches the CWE-89 SQL Injection weakness listed in the record.

Impact

  • The CNA scores the issue at 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Reading the vector, this indicates network reachability, low complexity, no privileges or user interaction required, and high confidentiality, integrity and availability impact (inference from the vector).
  • The Joomla security contact also provides a 4.0 score of 8.7.
  • The record does not describe which data could be exposed or which actions could be achieved. This is unknown.

Affected products and versions

  • Product listed: Joomcoder Joomcck.
  • Versions listed: from 1.0 up to and including 6.4.0.
  • The record does not break down editions or build dates within this range. Consult the vendor website for version details.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted.
  • The record gives an EPSS probability of 0.00564 and a percentile of 0.45376.

Remediation and mitigation

  • The record contains no fixed version and no vendor patch reference. Treat this as unknown, not as proof that no fix exists.
  • Contact Joomcoder through its website for update information and confirm the installed JoomCCK version.
  • Until a fix is verified, consider limiting exposure of the affected front-end functionality, reviewing whether the extension is still needed, and keeping the database account used by the site at least privilege.

Detection guidance

  • Inventory Joomla sites that have JoomCCK installed and record their versions.
  • Review web server and application logs for unusual or malformed parameters sent to JoomCCK front-end endpoints.
  • Watch for database errors that reference unexpected query syntax, since these can signal injection attempts.

Limitations of the available information

  • The record provides no fixed version, no exploitation evidence, no detailed exploit conditions and no vendor advisory beyond the product homepage.
  • The specific component or endpoint is not named.
  • The EPSS date in the record (2026-10-13) is later than the publication date (2026-06-28), so the EPSS figures should be interpreted with caution.

Frequently asked questions

Is this CVE being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions of JoomCCK are affected?

The record lists Joomcoder Joomcck versions from 1.0 up to and including 6.4.0. The record does not list a fixed version, so confirm your installed version with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.