CVE-2026-101110

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(), whose only real protection is a keyword blacklist that, on detecting the literal substring select, wraps the value in $db->quote() instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two conditions: a first request to prime session-stored sort defaults, and a trailing decoy comment (-- xselect) that satisfies the blacklist’s substring check without altering the payload’s effect.

• CWE-89

• https://www.ordasoft.com/

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-101101A vulnerability has been found in ag-ui-protocol ag-ui up to…4.3
• CVE-2026-101102A vulnerability was found in deepseek-ai deepseek-harness up…6.3
• CVE-2026-101105A vulnerability was determined in code-projects Matrimonial …6.3
• CVE-2026-101108Joomla Extension - ordasoft.com - Unauthenticated SQL Inject…9.3
• CVE-2026-101109Joomla Extension - ordasoft.com - Reflected Cross-Site Scrip…5.3
• CVE-2026-10111A flaw has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM…7.3
• CVE-2026-101111Joomla Extension - ordasoft.com - Reflected Cross-Site Scrip…5.3
• CVE-2026-10112A vulnerability has been found in sambitraj STUDENT-MANAGEME…2.4
• CVE-2026-10113A vulnerability was found in Open5GS up to 2.7.7. Affected b…4.3
• CVE-2026-101131A vulnerability was identified in deepseek-ai deepseek-harne…3.3
• CVE-2026-101132A security flaw has been discovered in DeepSeek deepseek-har…3.1
• CVE-2026-101139A vulnerability was detected in Webkul Bagisto up to 2.4.6. …2.7