Unrated severityNVD Advisory· Published Jun 28, 2026· Updated Jun 29, 2026

Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1

CVE-2026-49048

Description

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

Affected products

Joomla/JoomCCKllm-create
Range: <6.4.1
Joomcoder.com/JoomCCKllm-create
Range: <6.4.1

Patches

Vulnerability mechanics

References

www.joomcoder.commitreproduct

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000