CVE-2026-49048

The CVE concerns the Joomla extension JoomCCK. A front-end controller task builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation, leading to SQL injection. Affected product/component: JoomCCK for Joomla; vu...