CVE-2025-40636CWE-89sql-injection
CVE-2025-40636
published October 3, 2025
What it is
SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisitcounter’ cookie at all endpoints where the plugin counts visits.
The record
Technical detail
- CVSS
- 9.3 · NONE
- CVSS v4.0
- Not supplied
- EPSS
- 0.00290 · 20.4th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2025-10-03T16:15Z
References (1)
EPSS history
Timeline