Paper/Archive/CVE-2025-49467

CVE-2025-49467

jevents.net / GWE Systems Ltd JEvents component for Joomla — Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla

EPSS 0.3%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 25.1.251 × 205.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.

Affected

ProductAffectedFixed inSource

JEvents component for Joomla1.0.0-3.6.82–CNA

JEvents component for Joomla3.6.83-3.6.873.6.82.1CNA

Scores by source

Joomla (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:Amber

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjevents.net