CVE-2025-40636: SQL injection in the mod_vvisit_counter module
Published Oct 3, 2025
·Updated
SQL injection vulnerability in Joomla module modvvisitcounter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cipvvisitcounter’ cookie at all endpoints where the plugin counts visits.
Affected Software
1 affected component
Joomla mod_vvisit_counter
Event History
Oct 3, 2025
CVE Published
via MITRE·11:24 AM
Data Sourced
via MITRE·11:24 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-40636?
CVE-2025-40636 is classified as a high severity SQL injection vulnerability.
2
How do I fix CVE-2025-40636?
To fix CVE-2025-40636, update the Joomla module mod_vvisit_counter to the latest version that addresses this vulnerability.
3
What versions of Joomla mod_vvisit_counter are affected by CVE-2025-40636?
Joomla mod_vvisit_counter version 2.0.4j3 is affected by CVE-2025-40636.
4
What can an attacker do with CVE-2025-40636?
An attacker can retrieve sensitive database content through the vulnerable module using the 'cip_vvisitcounter' cookie.
5
Is CVE-2025-40636 related to web application security?
Yes, CVE-2025-40636 is a web application security vulnerability that exposes Joomla sites to SQL injection attacks.