CVE-2025-22212

LOW

Convert Forms <4.4.9 - SQL Injection

Title source: llm

Description

A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend.

References (2)

Core 2

Core References

Product product

https://www.tassos.gr/

Third Party Advisory third-party-advisory

https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22212

View Writeup ZIP pw:eip

Scores

CVSS v3 2.7

EPSS 0.0001

EPSS Percentile 1.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

convert_forms_project/convert_forms 1.0.0 - 4.4.9

Published Mar 05, 2025

Tracked Since Feb 18, 2026