HIGH
Joomla! Component VMap 1.9.6 SQL Injection via loadmarker
Published Jun 19, 2026
8.8
HIGHCVSS 4.0
EPSS 0.49%
Description
Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.
Affected products
-
- Version 1.9.6StatusaffectedConstraints-
- Version
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- http://wdmtech.com/ product
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20189 Advisory
- https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/vmap/ product
- https://www.exploit-db.com/exploits/46229 exploitVDB Entry
- https://www.vulncheck.com/advisories/joomla-component-vmap-sql-injection-via-loadmarker third-party-advisoryThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://wdmtech.com/ | product | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20189 | Advisory | |
| https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/vmap/ | product | |
| https://www.exploit-db.com/exploits/46229 | exploitVDB Entry | |
| https://www.vulncheck.com/advisories/joomla-component-vmap-sql-injection-via-loadmarker | third-party-advisoryThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Jun 19, 2026
Updated Oct 1, 2026
Reserved Jun 19, 2026
Link CVE-2019-25753
CISA Vulnrichment
Updated Jun 22, 2026
ENISA EUVD
EUVD-2019-20189 Assigner VulnCheck
Published Jun 19, 2026
Updated Oct 1, 2026
Exploited since n/a
Link EUVD-2019-20189