Vulnerability · Published Jun 12, 2025 · Assigned by Joomla
CVE-2025-49467Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla
Critical 9.3
In plain English
A critical-severity SQL injection in JEvents component for Joomla from jevents.net / GWE Systems Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.3%top 74.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jevents.net / GWE Systems Ltd | JEvents component for Joomla | 1.0.0-3.6.823.6.83-3.6.87 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:Amber
References
- https://jevents.net/ product