CVE-2019-25759

HighCVSS 7.1

Published: 19/06/2026(UTC)Updated: 17/08/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

Joomla! Component vBizz version 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands.

Risk Assessment

This vulnerability may lead to the exposure of sensitive database information, including version and database names, posing a serious security threat to the organization.

Recommendation

It is recommended to update the vBizz component to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in Joomla! Component vBizz

CVE-2019-25758High
Joomla! Component vBizz version 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.

Original NVD description (English source)

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands to extract sensitive database information including version and database names.