Official Product Homepageproduct
http://wdmtech.com/ CVE-2019-25756
HIGH
Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard
Record summary
CVE-2019-25756 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.
Description
Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 22, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
vAccountBrowse Wdmtech / vAccount | CVE List | 2.0.2 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJoomla! Component vAccount 2.0.2 - 'vid' SQL InjectionExploitDB exploitby Ihsan SencanNot analyzed1 file
References
5Product Referenceproduct
https://extensions.joomla.org/extensions/extension/financial/cost-calculators/vaccount nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25756 ExploitDB-46226exploit
https://www.exploit-db.com/exploits/46226 VulnCheck Advisory: Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboardThird-party advisory
https://www.vulncheck.com/advisories/joomla-component-vaccount-sql-injection-via-vaccount-dashboard