Riskcovery

CVE-2025-49467

Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla

State
Published
Severity
9.3 Critical
Published
Jun 12, 2025
Updated
Jun 12, 2025
Reserved
Jun 5, 2025

Read the record on cve.org

Description

A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.

Scores

CVSSScoreVectorSource
4.09.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:AmberJoomla

Weaknesses

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
JEvents component for Joomlajevents.net / GWE Systems Ltd
  • 1.0.0-3.6.82Affected
  • 3.6.82.1Not affected
  • 3.6.83-3.6.87Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.