CVE-2026-49048CriticalPublished 17 July 2026

JoomCCK (com_joomcck) below 6.4.1 - Unauthenticated SQL Injection

JoomCCK (JoomCoder) versions up to and including 6.4.0 contain an unauthenticated SQL injection (CVE-2026-49048): a front-end controller task concatenates a request parameter directly into two SQL statements with no escaping or parameterisation, so an anonymous visitor can read from the site database. Scored CVSS 4.0 8.7 (High) by the Joomla CNA, and 9.8 (Critical) on the older CVSS 3.1 scale. Reported by Kamil Soltanov (not by mySites.guru). Update to JoomCCK 6.4.1 or later.

Affected versions: < 6.4.1

Official record: cve.org · NVD

Related vulnerabilities

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

Affected extensions and versions

CriticalCVE-2026-490482026-07-17

JoomCCK

Affected versions: < 6.4.1

Full advisory: our disclosure post

Our disclosure post

We Are Not the Only Ones Auditing Joomla Extensions

Two Joomla extension flaws went public via the Joomla CNA: a SQL injection in JoomCCK and a stored XSS in ChronoForms. Neither was ours. Update now.

17 Jul 2026

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

Rules current as of 25 August 2026.