CVE-2019-25757: Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter

Published Jun 19, 2026

Updated

Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vproductid and userid parameters. Attackers can send POST requests to the component with crafted SQL payloads in these parameters to extract sensitive database information including version and database names.

Affected Software

2 affected components

Joomla vWishlist=1.0.1

Wdmtech Vwishlist Joomla\!=1.0.1

Event History

Jun 19, 2026

CVE Published

via MITRE·05:31 PM

Data Sourced

via MITRE·05:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-25757?

CVE-2019-25757 has a severity rating of high with a score of 7.1.

How do I fix CVE-2019-25757?

To mitigate CVE-2019-25757, update Joomla vWishlist to the latest version that addresses this SQL injection vulnerability.

What type of vulnerability is CVE-2019-25757?

CVE-2019-25757 is classified as an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries.

Who is affected by CVE-2019-25757?

Users of Joomla vWishlist version 1.0.1 are affected by CVE-2019-25757.

Can CVE-2019-25757 be exploited remotely?

Yes, CVE-2019-25757 can be exploited remotely by authenticated attackers through crafted POST requests.