An unauthenticated SQL injection vulnerability exists in the OrdaSoft Simple Membership extension for Joomla versions 1.0.0 through 7.4.0. The vulnerability occurs because the extension's site/simplemembership.php script dispatches the task=checkLoginPass without any authentication or access control. It reads a login request parameter using Joomla's generic input filter, which does not sanitize quotes or SQL syntax, and directly concatenates this input into an SQL query without escaping or parameterization.
CVE-2026-102781 is a medium severity vulnerability in the OrdaSoft Touch Slider extension for Joomla versions 1.0.0 through 5.4.5. It allows unauthenticated attackers to perform destructive create, read, update, and delete (CRUD) operations due to improper access control. Specifically, the module's AJAX handler lacks user authentication, authorization checks, and CSRF protection. Attackers can delete slider images by guessing sequential IDs or replace entire database tables with attacker-supplied content via a multipart upload.
An unauthenticated SQL injection vulnerability exists in OrdaSoft Joomla CCK versions up to and including 8.3.15. The flaw arises because the order column for records is user-controlled and not properly validated, allowing attackers to inject malicious SQL commands. This vulnerability has a critical severity rating with a CVSS score of 9.3.
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.
A reflected cross-site scripting (XSS) vulnerability exists in the ordasoft.com Book Library (Free) extension for Joomla versions 1.0.0 through 6.4.6. The vulnerability occurs because the public book-detail page template directly echoes the raw 'title' request parameter into a double-quoted HTML attribute without any escaping. This allows an attacker to inject arbitrary HTML or JavaScript by including a double quote in the 'title' parameter, potentially leading to script execution in the context of the victim's browser.
A reflected cross-site scripting (XSS) vulnerability exists in the Vehicle Manager (Free) extension for Joomla versions 1.0.0 through 6.5.7. The vulnerability occurs because the public vehicle-detail page (task=view) directly inserts the title request parameter into a double-quoted HTML attribute without proper output encoding. This allows an attacker to inject arbitrary HTML or script code by including a double-quote character in the parameter, potentially leading to script execution in the victim's browser.
An unauthenticated SQL Injection vulnerability exists in the ordasoft.com Book Library (Free) extension for Joomla versions 1.0.0 through 6.4.6. The vulnerability arises from improper sanitization of user-supplied 'field' and 'direction' parameters in the books() function, which are concatenated directly into an unquoted ORDER BY clause. This flaw allows attackers to manipulate SQL queries without proper neutralization, potentially leading to high-impact consequences.
A reflected cross-site scripting (XSS) vulnerability exists in the ordasoft.com Real Estate Manager (Free) extension for Joomla versions 1.0.0 through 6.7.8. The issue occurs on the public property-detail page's 'leave a review' form, where the title field is populated directly from user input without proper escaping or filtering. This allows an attacker to inject malicious script code that executes in the browser of anyone who clicks a crafted link.
An unauthenticated SQL injection vulnerability exists in the ordasoft.com Real Estate Manager (Free) extension for Joomla versions 1.0.0 through 6.7.8. The vulnerability arises from improper neutralization of special elements in the order_field parameter used in SQL ORDER BY clauses on the frontend property-listing queries. This allows an attacker to inject arbitrary SQL commands without authentication.
An unauthenticated SQL Injection vulnerability exists in the Vehicle Manager (Free) extension for Joomla versions 1.0.0 through 6.5.7. The issue arises from improper sanitization of the order_field and order_direction parameters used in an unquoted ORDER BY clause, allowing attackers to inject SQL commands. This vulnerability has a critical severity with a CVSS score of 9.3.
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: mod_osgallery_search is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content.
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions updateOSGallery(), reached via task=update_osgallery, read a JSON request body and called the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check of any kind. Any function name compatible with a single argument was directly reachable, including system, exec, shell_exec, and passthru.