CVE-2026-76570
Critical
Description
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.
SeverityCritical
CVSS9.1
Exploit probability40. percentile0.5%
ProductJoomcode Jc Tables
PublishedSep 30, 2026
First seenSep 30, 2026
Weakness typeCWE-89SQL injection
How to fix
Update
- joomcode jc_tables1.21.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joomcode jc_tables | v < 1.21.1 | 1.21.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.