CVE-2019-25762
Joomla! Component JoomProject 1.1.3.2 Information Disclosure
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 19, 2026
- Updated
- Jun 22, 2026
- Reserved
- Jun 19, 2026
Description
Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
JoomProjectJoomboost |
|
References
- ExploitDB-46121exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: Joomla! Component JoomProject 1.1.3.2 Information Disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.