CVE-2019-25758CWE-434unrestricted-file-upload

CVE-2019-25758

High · published June 19, 2026

CVSS v3.1

8.8

EPSS

Percentile

62.5

In the wild

Unconfirmed

What it is

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.01002 · 62.5th percentile
Weakness: CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2026-06-19T22:16Z

Affected products (1)

Product	Versions	Fixed in
wdmtech/vbizz	≤ 1.0.7	—

References (4)

http://wdmtech.com/ · [email protected]https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/ · [email protected]https://www.exploit-db.com/exploits/46224 · [email protected]https://www.vulncheck.com/advisories/joomla-component-vbizz-remote-code-execution · [email protected]

EPSS history

Timeline

19 JUN 17:35Z
Joomla! Component vBizz 1.0.7 Remote Code Execution
cvelistv5