CVE-2019-25756 - Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard

Back Back to CVE browser

HIGH

Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard

Published Jun 19, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.49%

Description

Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.

Affected products

Vendor Wdmtech Product vAccount Default
n/a
- Version
  2.0.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wdmtech

vAccount

n/a

Version	Status	Constraints
2.0.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

http://wdmtech.com/
product
https://extensions.joomla.org/extensions/extension/financial/cost-calculators/vaccount/
product
https://www.exploit-db.com/exploits/46226
exploitVDB Entry
https://www.vulncheck.com/advisories/joomla-component-vaccount-sql-injection-via-vaccount-dashboard
third-party-advisoryThird Party Advisory

Link	Providers	Tags
http://wdmtech.com/		product
https://extensions.joomla.org/extensions/extension/financial/cost-calculators/vaccount/		product
https://www.exploit-db.com/exploits/46226		exploitVDB Entry
https://www.vulncheck.com/advisories/joomla-component-vaccount-sql-injection-via-vaccount-dashboard		third-party-advisoryThird Party Advisory