Threat Intelligence / CVE / CVE-2026-49048

CVE-2026-49048 — joomcoder.com JoomCCK extension for Joomla

CVSS v3.1 9.8 (CRITICAL) · CVSS v4.0 8.7 · EPSS 0.2% (higher than 19.5% of all scored CVEs) · Priority 7.7/10 · Published 2026-06-28

As of 2026-06-29, CVE-2026-49048 is a CRITICAL-severity vulnerability in joomcoder.com JoomCCK extension for Joomla, CVSS v3.1 9.8, EPSS 0.2% (19.5th percentile). No Threadlinqs-tracked threat campaign has been attributed to CVE-2026-49048 as of 2026-06-29; the identifier is re-checked against the Threadlinqs threat corpus on every daily ingest.

Last updated: 2026-06-29

What is CVE-2026-49048?

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

The record classifies CVE-2026-49048 under weakness class CWE-89. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 73 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 9.8 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 base score: 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS (FIRST): 0.2% probability of exploitation in the next 30 days, higher than 19.5% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 7.7/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-06-28, last modified 2026-06-29

Is CVE-2026-49048 being exploited?

Weaponised exploit code for CVE-2026-49048 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 42 in the Threadlinqs vulnerability feed.

KARA-git/CVE-2026-49048-JoomCCK-SQLi (github)

Affected products and versions

joomcoder.com: JoomCCK extension for Joomla

How to fix CVE-2026-49048

No vendor patch reference has been recorded for CVE-2026-49048 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-49048

No threat campaign in the Threadlinqs corpus currently references CVE-2026-49048, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.

Sources

Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-06-30. This product uses the NVD API but is not endorsed or certified by the NVD.

Issue tracking and product pages

joomcoder.com — product

Full detection coverage & IOCs for threats exploiting CVE-2026-49048 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence