CVE-2026-88854PoC

MEDIUMCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: mod_osgallery_search is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://www.OrdaSoft.com/

Weakness type (CWE)

CWE-89

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 3 signals
PoC mentioned or linked in 7 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 11 signals
Disclosure: 2 classified signals
Peaked 3d ago at 5 mentions (2026-09-21); latest day: 1
13 total mentions across 5 days

Deep dive

Activity timeline13 mentions / 5d

Signal classification6 categories

PoC

646.2%

Patch

215.4%

Disclosure

215.4%

False Positive

17.7%

Exploit

17.7%

General

17.7%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-20	4	False Positive1Patch1PoC2
2026-09-21	5	Disclosure1Exploit1General1PoC2
2026-09-22	2	Disclosure1PoC1
2026-09-26	1	PoC1
2026-10-21	1	Patch1

Full discourse13 posts

Ryx@PadhiyarRushi40d
PoC
OrdaSoft Joomla Gallery search box is unauth SQLi. "$input->getVar()" is not a filter!!! CVE-2026-88854: "showSearchResult()" / "showSearchResultAjax()" take "textsearch"/"searchText", strip tags, then concatenate into a LIKE clause. Public module "mod_osgallery_search". UNION / EXTRACTVALUE reads "#__users" hashes with no login. Affects <6.2.7. Python checker + extract PoC landed Sept 20!! https://github.com/murrez/CVE-2026-88854 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #Joomla #BugBounty #SQLi
Post summary
Disclosure of CVE-2026-88854, an unauthenticated SQL injection in OrdaSoft Joomla Gallery, with technical details and a linked GitHub Python checker/PoC; no active exploitation or patch mentioned.
140154730
954 followersView on X
Rıdvan Yağlı@ridvanyagli46d
PoC
🔴 CVE-2026-88854 — OrdaSoft Joomla Gallery'de kritik SQL Injection açığı için PoC yayınlandı. OrdaSoft OS Responsive Image Gallery 1.0.0–6.2.6 sürümlerini etkileyen açık, kimlik doğrulaması gerektirmeden SQL sorgularının manipüle edilmesine ve uygun koşullarda veritabanı içeriğinin okunmasına izin verebiliyor. CVSS: 9.3 Critical. Yamalanmış sürüm: 6.2.7+ PoC: https://github.com/murrez/CVE-2026-88854
Post summary
CVE-2026-88854 is a critical SQL injection vulnerability in OrdaSoft Joomla Gallery with CVSS 9.3, for which a PoC has been published and linked to a GitHub repository. A patched version (6.2.7+) is available, though active exploitation is not explicitly reported.
020125966
2.5K followersView on X
dbugs@ptdbugs45d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-88854 PT ID: PT-2026-95994 Vendor: Joomla/OrdaSoft Product: OrdaSoft Joomla Gallery free extension for Joomla Description: Joomla Extension - http://OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: mod_osgallery_search is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content. References: • https://dbu.gs/vulnerability/PT-2026-95994 • https://github.com/murrez/cve-2026-88854
Post summary
The text announces the discovery of a PoC/exploit for an unauthenticated SQL injection vulnerability in OrdaSoft Joomla Gallery extension (CVE-2026-88854), providing technical details and a link to a GitHub repository containing the exploit code.
00051619
3.7K followersView on X
ExploitGrid@exploitgrid45d
Disclosure
🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-88854 - EXPLOIT CVE-2026-94036 - EXPLOIT CVE-2026-94003 CVE-2026-94089 CVE-2026-94097 ..🧵👇
Post summary
A daily threat digest listing five CVEs, with two marked as having exploits available, but no technical details, PoC links, or patch information provided.
1102097
403 followersView on X
ExploitGrid@exploitgrid45d
General
Top CVEs w/ public exploits (Sep 21): CVE-2026-88854 Joomla Extension - https://OrdaSoft.com - Unauthenticat... CVE-2026-94036 D-Link DIR-X1860/DIR-X1860Z routerd ubus access... CVE-2026-86555 Hardcoded Key Vulnerability in ZTE SmartLife APP Protect via https://exploitgrid.net
Post summary
The tweet lists several CVEs with public exploit references and URLs but provides no concrete PoC, exploit tool, active exploitation evidence, patch, or technical details.
00030118
403 followersView on X
ExploitGrid@exploitgrid45d
PoC
[CVE] CVE-2026-88854 [CRITICAL/PoC] #Joomla Extension - https://OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft J... ⚠️ Recorded Exploit Available 🔗 https://exploitgrid.net/cve/CVE-2026-88854
Post summary
This post announces CVE-2026-88854, a critical unauthenticated SQL injection in an OrdaSoft Joomla extension, and highlights the availability of a recorded Proof of Concept exploit via a linked resource.
1101055
155 followersView on X
mürrez@murrezsec46d
PoC
CVE-2026-88854 (CVSS 9.3) — unauthenticated SQLi in OrdaSoft Joomla Gallery (com_osgallery ≤ 6.2.6). Public image search: showSearchResultAjax + textsearch → unsanitized LIKE concat. PoC: check / mass scan 🔗 https://github.com/murrez/CVE-2026-88854 Authorized testing only.
Post summary
The tweet discloses CVE-2026-88854, an unauthenticated SQLi in OrdaSoft Joomla Gallery, shares a PoC via GitHub, and provides technical details but no patch or exploit.
00030108
636 followersView on X
ExploitGrid@exploitgrid44d
PoC
🔴 CRITICAL / PoC Available ├ CVE-2026-88854 — Joomla (OrdaSoft) · Unauth SQLi └ CVE-2026-94036 — D-Link DIR-X1860 · ubus ACL bypass
Post summary
The text announces two CVEs (Joomla SQLi and D-Link ACL bypass) with explicit confirmation of available PoCs and technical vulnerability details, but lacks exploit tools, active exploitation, or patch information.
1001043
202 followersView on X
ExploitGrid@exploitgrid45d
PoC
🔴 CRITICAL / PoC Available CVE-2026-88854: Joomla (OrdaSoft) · Unauth SQLi CVE-2026-94036: D-Link DIR-X1860 · ubus ACL bypass
Post summary
The post announces two critical CVEs and states that a PoC is available, providing brief vulnerability type details without active exploitation, named exploit tools, or remediation guidance.
1000073
155 followersView on X
Hugo | DevOps | Cybersecurity@HugoValters16d
Patch
CVE-2026-88854: unauthenticated SQLi in OrdaSoft Joomla Gallery under 6.2.7, CVSS 9.1, no patch yet. Update now. #CVE #infosec #Joomla https://www.valtersit.com/cve/CVE-2026-88854/ #OrdaSoft #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text discloses CVE-2026-88854 (unauthenticated SQLi, CVSS 9.1) in OrdaSoft Joomla Gallery under 6.2.7 with technical details, states no patch is available yet, and urges users to update now, making Patch the primary classification. Confidence is Medium due to the contradictory 'no patch yet' and 'Update now' statements.
0000035
1.1K followersView on X
Cybersecurity News DE@cybsecuritynews44d
Disclosure
#schwachstellen Kritische Lücken in OrdaSoft Joomla Gallery: SQL-Injection und RCE bedrohen Joomla-Sites #cve202688854 #cve202688856 #cve202688857 #joomla #joomlagallery #ordasoft https://cybersecurity-news.de/ordasoft-joomla-gallery-schwachstellen-cve-2026-88854-cve-2026-88856-cve-2026-88857
Post summary
The tweet discloses critical vulnerabilities in OrdaSoft Joomla Gallery, noting SQL‑Injection and RCE issues that threaten Joomla sites. No proof‑of‑concept, exploit tools, patches, or evidence of active exploitation are mentioned.
0000028
13 followersView on X
CVE@CVEnew46d
Patch
CVE-2026-88854 Joomla Extension - https://OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSe… https://www.cve.org/CVERecord?id=CVE-2026-88854
Post summary
The text discloses CVE-2026-88854, an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension for Joomla versions older than 6.2.7. It provides technical details and indicates a fixed version (6.2.7), framing the primary takeaway as a patch recommendation.
00000856
58.1K followersView on X
Severity Daily@severitydaily46d
False Positive
Two OrdaSoft Joomla Gallery SQL injections are both titled "Unauthenticated." Only one is — a 9.3 anyone can reach from a public search box. The other's own vector says it needs a login. No exploitation reported. https://severitydaily.com/ordasoft-joomla-gallery-cve-2026-88854-88855-titled-unauthenticated-only-one-is/
Post summary
The post corrects the classification of two OrdaSoft Joomla Gallery SQLi vulnerabilities, noting only one is truly unauthenticated (CVSS 9.3) while the other requires authentication, and confirms no active exploitation.
0000032
24 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-88854

Ryx[verified]@PadhiyarRushiPoC

Disclosure of CVE-2026-88854, an unauthenticated SQL injection in OrdaSoft Joomla Gallery, with technical details and a linked GitHub Python checker/PoC; no active exploitation or patch mentioned.

Rıdvan Yağlı[verified]@ridvanyagliPoC

CVE-2026-88854 is a critical SQL injection vulnerability in OrdaSoft Joomla Gallery with CVSS 9.3, for which a PoC has been published and linked to a GitHub repository. A patched version (6.2.7+) is available, though active exploitation is not explicitly reported.

dbugs[verified]@ptdbugsExploit

The text announces the discovery of a PoC/exploit for an unauthenticated SQL injection vulnerability in OrdaSoft Joomla Gallery extension (CVE-2026-88854), providing technical details and a link to a GitHub repository containing the exploit code.

Hugo | DevOps | Cybersecurity[verified]@HugoValtersPatch

The text discloses CVE-2026-88854 (unauthenticated SQLi, CVSS 9.1) in OrdaSoft Joomla Gallery under 6.2.7 with technical details, states no patch is available yet, and urges users to update now, making Patch the primary classification. Confidence is Medium due to the contradictory 'no patch yet' and 'Update now' statements.

Severity Daily[verified]@severitydailyFalse Positive

The post corrects the classification of two OrdaSoft Joomla Gallery SQLi vulnerabilities, noting only one is truly unauthenticated (CVSS 9.3) while the other requires authentication, and confirms no active exploitation.

ExploitGrid@exploitgridDisclosure

A daily threat digest listing five CVEs, with two marked as having exploits available, but no technical details, PoC links, or patch information provided.

ExploitGrid@exploitgridGeneral

The tweet lists several CVEs with public exploit references and URLs but provides no concrete PoC, exploit tool, active exploitation evidence, patch, or technical details.

ExploitGrid@exploitgridPoC

This post announces CVE-2026-88854, a critical unauthenticated SQL injection in an OrdaSoft Joomla extension, and highlights the availability of a recorded Proof of Concept exploit via a linked resource.