ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-101108

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

CVSS 4.0 9.3 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-101108

Published

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-101108

Published

com_vehiclemanager

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "com_vehiclemanager",
                    "product": "Vehicle Manager (Free) extension for Joomla",
                    "vendor": "ordasoft.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-6.5.7"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON