CVE-2026-102782
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:
| CWE | CWE-89 |
| Vendor | ordasoft.com |
| Product | ordasoft simple membership extension for joomla |
| Published | Oct 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for ordasoft.com ordasoft simple membership extension for joomla
Be the first to know when new unknown vulnerabilities affecting ordasoft.com ordasoft simple membership extension for joomla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
ordasoft.com / OrdaSoft Simple Membership extension for Joomla
1.0.0-7.4.0