What is GHSA-h9xw-5459-2pqw?

GHSA-h9xw-5459-2pqw is a security advisory published by GitHub Security Advisories with Critical severity. Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in...

Which CVE IDs does GHSA-h9xw-5459-2pqw cover?

GHSA-h9xw-5459-2pqw covers the following CVE IDs: CVE-2026-76570. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-h9xw-5459-2pqwCritical

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-76570 →

📋 Description

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-76570
https://www.joomcode.com
https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rce
https://github.com/advisories/GHSA-h9xw-5459-2pqw