CVE-2019-25759CWE-89sql-injection

CVE-2019-25759

High · published June 19, 2026

CVSS v3.1

7.1

EPSS

Percentile

33.6

In the wild

Unconfirmed

What it is

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands to extract sensitive database information including version and database names.

The record

Technical detail

CVSS v3.1: 7.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00405 · 33.6th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-06-19T22:16Z

Affected products (1)

Product	Versions	Fixed in
wdmtech/vbizz	≤ 1.0.7	—

References (4)

http://wdmtech.com/ · [email protected]https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/ · [email protected]https://www.exploit-db.com/exploits/46223 · [email protected]https://www.vulncheck.com/advisories/joomla-component-vbizz-sql-injection · [email protected]

EPSS history

Timeline

19 JUN 17:38Z
Joomla! Component vBizz 1.0.7 SQL Injection
cvelistv5