CVE-2026-49048

Critical · CVSS 9.8

JoomCCK (Joomla extension by JoomCoder) — SQL Injection (CWE-89) via unsanitised front-end controller task parameter concatenation

CVSS: 9.8; nvd
EPSS: 0.51%; 39th pct
KEV: No
Class: other; CWE-89

Description

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

Search profile — drives PoC discovery

Symbols JoomCCKtaskcontrollerSQL concatenationrequest parametercom_joomcckfront-end controllerquery string

Keywords CVE-2026-49048JoomCCKJoomCoderJoomla JoomCCK SQL injectioncom_joomcck SQLiJoomCCK front-end controller task SQLiJoomCCK unauthenticated SQL injectionJoomCCK PoCJoomCCK exploit

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

KARA-git/CVE-2026-49048-JoomCCK-SQLi needs review

recent activity

gh_search · PHP

★ 1

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

https://www.joomcoder.com/

Status: enriched · ingested 2026-06-30T18:00:22.000Z · profiled 2026-07-01T18:30:14.000Z