CVE-2019-25756: Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard

Published Jun 19, 2026

Updated

Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.

Affected Software

2 affected components

Joomla! vAccount=2.0.2

Wdmtech Vaccount Joomla\!=2.0.2

Event History

Jun 19, 2026

CVE Published

via MITRE·05:28 PM

Data Sourced

via MITRE·05:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-25756?

The severity of CVE-2019-25756 is rated as high with a score of 8.2.

How do I fix CVE-2019-25756?

To fix CVE-2019-25756, it is recommended to update Joomla! Component vAccount to the latest version that addresses this SQL injection vulnerability.

What type of vulnerability is CVE-2019-25756?

CVE-2019-25756 is classified as an SQL injection vulnerability.

Who is affected by CVE-2019-25756?

CVE-2019-25756 affects Joomla! Component vAccount version 2.0.2.

What impact can CVE-2019-25756 have?

CVE-2019-25756 can allow unauthenticated attackers to execute arbitrary SQL queries, which can compromise sensitive data.