CVE-2019-25757 - Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter

Back Back to CVE browser

HIGH

Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter

Published Jun 19, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.40%

Description

Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vproductid and userid parameters. Attackers can send POST requests to the component with crafted SQL payloads in these parameters to extract sensitive database information including version and database names.

Affected products

Vendor Wdmtech Product vWishlist Default
n/a
- Version
  1.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wdmtech

vWishlist

n/a

Version	Status	Constraints
1.0.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

http://wdmtech.com/
product
https://extensions.joomla.org/extensions/extension/extension-specific/virtuemart-extensions/vwishlist/
product
https://www.exploit-db.com/exploits/46225
exploitVDB Entry
https://www.vulncheck.com/advisories/joomla-vwishlist-sql-injection-via-vproductid-parameter
third-party-advisoryThird Party Advisory

Link	Providers	Tags
http://wdmtech.com/		product
https://extensions.joomla.org/extensions/extension/extension-specific/virtuemart-extensions/vwishlist/		product
https://www.exploit-db.com/exploits/46225		exploitVDB Entry
https://www.vulncheck.com/advisories/joomla-vwishlist-sql-injection-via-vproductid-parameter		third-party-advisoryThird Party Advisory