Skip to content
OpenAdvisories

Vendor

ordasoft.com

14 known vulnerabilities.

Products

OrdaSoft Joomla Gallery free extension for Joomla 4 OrdaSoft Joomla Gallery extension for Joomla 4 OrdaSoft Joomla CCK 2 Real Estate Manager (Free) extension for Joomla 2 Vehicle Manager (Free) extension for Joomla 2 Book Library (Free) extension for Joomla 2 OrdaSoft Simple Membership extension for Joomla 1 Touch Slider extension for Joomla 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-102782 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0

    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request para…

    ordasoft.com OrdaSoft Simple Membership extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-102428 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

    ordasoft.com OrdaSoft Joomla CCK Web / CMS
  • Critical 10.0
    CVE-2026-102427 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

    Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in th…

    ordasoft.com OrdaSoft Joomla CCK Web / CMS
  • Critical 9.3
    CVE-2026-101110 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(),…

    ordasoft.com Book Library (Free) extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-100752 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full …

    ordasoft.com Real Estate Manager (Free) extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-101108 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing…

    ordasoft.com Vehicle Manager (Free) extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-88854 Public exploit

    Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

    Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), whic…

    ordasoft.com OrdaSoft Joomla Gallery free extension for Joomla OrdaSoft Joomla Gallery extension for Joomla Web / CMS