Official Product Homepageproduct
http://wdmtech.com/ CVE-2019-25757
HIGH
Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter
Record summary
CVE-2019-25757 has a selected CVSS score of 7.1 (high); EIP currently links 1 catalogued exploit.
Description
Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vproductid and userid parameters. Attackers can send POST requests to the component with crafted SQL payloads in these parameters to extract sensitive database information including version and database names.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 23, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
vWishlistBrowse Wdmtech / vWishlist | CVE List | 1.0.1 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJoomla! Component vWishlist 1.0.1 - SQL InjectionExploitDB exploitby Ihsan SencanNot analyzed1 file
References
5Product Referenceproduct
https://extensions.joomla.org/extensions/extension/extension-specific/virtuemart-extensions/vwishlist nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25757 ExploitDB-46225exploit
https://www.exploit-db.com/exploits/46225 VulnCheck Advisory: Joomla vWishlist 1.0.1 SQL Injection via vproductid ParameterThird-party advisory
https://www.vulncheck.com/advisories/joomla-vwishlist-sql-injection-via-vproductid-parameter