CVE-2018-25330
Joomla! EkRishta 2.10 Persistent XSS and SQL Injection
- State
- Published
- Severity
- 8.8 High
- Published
- May 17, 2026
- Updated
- May 18, 2026
- Reserved
- May 17, 2026
Description
Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters. Attackers can inject script payloads in profile information fields like Address that execute when users visit the profile, or submit SQL injection payloads via the phone_no parameter to the user_setting endpoint to manipulate database queries.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Joomla! extension EkRishtaJoomlaextensions |
|
References
- ExploitDB-44660exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: Joomla! EkRishta 2.10 Persistent XSS and SQL Injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.