CVE-2026-49048

The JoomCCK extension for Joomla (specifically version 6.4.0 and earlier) is vulnerable to unauthenticated SQL injection (CWE-89) via a front-end controller task (task=tags.save). The root cause is a combination of a missing authorization check in the custom MVC dispatcher and the direct concaten...