CVE-2025-25228

CVE-2025-25228: Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla

Vendor Virtuemart.net

Product Virtuemart component for Joomla

Weakness CWE-89 · SQLi

Published April 21, 2025

Last update May 7, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend.

Key dates

02Disclosure timeline

April 21, 2025 CVE published

May 7, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-25228 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

04Related CVE

CVE-2026-32478 WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability CVE-2026-66658 WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' CVE-2026-81277 WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability CVE-2026-77823 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter