Vulnerability · Published Sep 28, 2026 · Assigned by Joomla

CVE-2026-100752Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

Critical 9.3

In plain English

A critical-severity SQL injection in Real Estate Manager (Free) extension for Joomla from ordasoft.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.

Affected products (as reported)

Vendor	Product	Versions
ordasoft.com	Real Estate Manager (Free) extension for Joomla	1.0.0-6.7.8

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.ordasoft.com/ product