CVE-2025-25228

LOW

VirtueMart 1.0.0-4.4.7 - SQL Injection

Title source: llm

Description

A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend.

References (2)

Core 2

Core References

Product product

https://virtuemart.net/

Broken Link third-party-advisory

https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-25228

View Writeup ZIP pw:eip

Scores

CVSS v3 3.8

EPSS 0.0019

EPSS Percentile 40.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

virtuemart/virtuemart 1.0.0 - 4.4.7

Published Apr 21, 2025

Tracked Since Feb 18, 2026