EIP-2026-108586

PRE-CVE

Joomla! Component com_virtuemart 2.0.22a - SQL Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-108586. PoCs published by Matias Fontanini.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Joomla! VirtueMart component versions 2.0.8 to 2.0.22a. The 'virtuemart_userinfo_id' parameter in the 'removeAddressST' task is not properly sanitized, allowing arbitrary SQL query execution.

Description

Joomla! Component com_virtuemart 2.0.22a - SQL Injection

Exploits (1)

exploitdb WORKING POC
by Matias Fontanini · textwebappsphp
https://www.exploit-db.com/exploits/27879

This exploit demonstrates a SQL injection vulnerability in Joomla! VirtueMart component versions 2.0.8 to 2.0.22a. The 'virtuemart_userinfo_id' parameter in the 'removeAddressST' task is not properly sanitized, allowing arbitrary SQL query execution.

Classification
Working Poc 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Joomla! VirtueMart component <= 2.0.22a
Auth required
Prerequisites: Authenticated user account (customer role)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026