A flaw in the front‑end CRUD API controller of the JCTables extension for Joomla allows an unauthenticated attacker to inject arbitrary SQL through request parameters that are directly concatenated into database queries. Because the controller lacks Joomla token validation and authentication checks, an attacker can read sensitive data and modify table contents. The vulnerability grants the attacker unfiltered database access, leading to potential data exfiltration or corruption.

The vulnerability affects the JCTables extension for Joomla provided by joomcode.com, with versions earlier than 1.21.1. Users who have not updated their extension to 1.21.1 or later are exposed.

The CVSS score of 10 reflects critical severity. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. The attacker can launch the exploit over the public internet via the exposed CRUD API, requiring no user authentication. Given the lack of input sanitization and authentication, exploitation is straightforward for an attacker with network access to the Joomla site.