These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-102782 vulnerability is an unauthenticated SQL injection issue in the OrdaSoft Simple Membership extension for Joomla versions less than 7.4.0. The vulnerability exists in the site/simplemembership.php file, where the task=checkLoginPass parameter is processed without authentication or access control. The input filter used by Joomla strips HTML/script tags but does not sanitize quotes or SQL [truncated]
CVE-2026-102781 is a medium-severity vulnerability in the OrdaSoft Touch Slider extension for Joomla, allowing unauthenticated destructive CRUD operations. The vulnerability exists in versions prior to 5.4.6 and can be exploited through a guessable sequential ID attack vector or by uploading a zip file to replace critical tables. Joomla site administrators and security teams should assess their exposure a [truncated]
The OrdaSoft Joomla Gallery extension for Joomla versions less than 6.2.7 contains a critical vulnerability that allows authenticated users with core.manage privileges to execute remote code. This is possible because the saveWatermark() function uploads files into a web-accessible directory using client-supplied filenames without any checks or sanitization. Attackers can exploit this by uploading a .php f [truncated]
The OrdaSoft Joomla Gallery extension for Joomla versions prior to 6.2.7 contains a critical vulnerability, CVE-2026-88856, which allows authenticated, privileged remote code execution. This vulnerability is due to the updateOSGallery() function, accessible via task=update_osgallery, reading a JSON request body and calling the method field value as a live PHP function with the package field value as its a [truncated]
The OrdaSoft Joomla Gallery extension for Joomla is vulnerable to authenticated, privileged SQL injection. An attacker with core.manage permissions can exploit this vulnerability to gain full read/write access to the database, including extracting password hashes. This issue arises from the saveGallery() function, which fails to properly sanitize user-input values, concatenating them directly into SQL que [truncated]
CVE-2026-88854 is a critical unauthenticated SQL injection vulnerability in the OrdaSoft Joomla Gallery extension for Joomla versions less than 6.2.7. The vulnerability exists in the showSearchResult() and showSearchResultAjax() functions, which read the textsearch/searchText request parameter without proper filtering, allowing an attacker to inject malicious SQL code directly into a LIKE clause. This vul [truncated]
