CVE-2019-25759 - Joomla! Component vBizz 1.0.7 SQL Injection

Back Back to CVE browser

HIGH

Joomla! Component vBizz 1.0.7 SQL Injection

Published Jun 19, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.40%

Description

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands to extract sensitive database information including version and database names.

Affected products

Vendor Wdmtech Product vBizz Default
n/a
- Version
  1.0.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wdmtech

vBizz

n/a

Version	Status	Constraints
1.0.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (5)

http://wdmtech.com/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20195
Advisory
https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/
product
https://www.exploit-db.com/exploits/46223
exploitVDB Entry
https://www.vulncheck.com/advisories/joomla-component-vbizz-sql-injection
third-party-advisoryThird Party Advisory

Link	Providers	Tags
http://wdmtech.com/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20195		Advisory
https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz/		product
https://www.exploit-db.com/exploits/46223		exploitVDB Entry
https://www.vulncheck.com/advisories/joomla-component-vbizz-sql-injection		third-party-advisoryThird Party Advisory