CVE-2019-25758 - Joomla! Component vBizz 1.0.7 Remote Code Execution

Back Back to CVE browser

HIGH

Joomla! Component vBizz 1.0.7 Remote Code Execution

Published Jun 19, 2026

8.7

HIGH

CVSS 4.0

EPSS 1.00%

Description

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.

Affected products

Vendor Wdmtech Product vBizz Default
n/a
- Version
  1.0.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wdmtech

vBizz

n/a

Version	Status	Constraints
1.0.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (5)

http://wdmtech.com/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20194
Advisory
https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/
product
https://www.exploit-db.com/exploits/46224
exploit
https://www.vulncheck.com/advisories/joomla-component-vbizz-remote-code-execution
third-party-advisoryThird Party Advisory

Link	Providers	Tags
http://wdmtech.com/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20194		Advisory
https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/		product
https://www.exploit-db.com/exploits/46224		exploit
https://www.vulncheck.com/advisories/joomla-component-vbizz-remote-code-execution		third-party-advisoryThird Party Advisory