Description
Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.
Published: 2026-06-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Joomla! Component VMap 1.9.6 is affected by a SQL injection flaw in the latlngbound parameter. An unauthenticated attacker can inject arbitrary SQL fragments via the GET request to index.php with option=com_vmap&task=loadmarker, allowing the execution of custom SQL queries. This can lead to extraction of sensitive database contents, data disclosure, and potentially unauthorized data manipulation.

Affected Systems

The flaw targets the Wdmtech VMap component for Joomla, specifically version 1.9.6. No other versions were identified as affected in this advisory.

Risk and Exploitability

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score is not available, but the lack of a KEV listing suggests it has not yet been confirmed as a widely exploited issue. Nonetheless, the vulnerability is exploitable remotely by any party that can send HTTP GET requests to the site, making it a realistic risk for publicly accessible Joomla deployments.

Generated by OpenCVE AI on June 19, 2026 at 20:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the VMap component to the latest release that contains the fix or uninstall the component if it is no longer needed.
  • Configure a web application firewall or server rules to block or sanitize the latlngbound parameter, allowing only numeric latitude/longitude values within valid ranges.
  • If an immediate upgrade is not feasible, temporarily disable the VMap component from the Joomla administrator or restrict access to the component's URLs.

Generated by OpenCVE AI on June 19, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 22 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 21 Jun 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Wdmtech
Wdmtech vmap
Vendors & Products Wdmtech
Wdmtech vmap

Fri, 19 Jun 2026 18:15:00 +0000

Type Values Removed Values Added
Description Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.
Title Joomla! Component VMap 1.9.6 SQL Injection via loadmarker
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wdmtech Vmap
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-06-22T17:13:36.630Z

Reserved: 2026-06-19T14:29:01.982Z

Link: CVE-2019-25753

cve-icon Vulnrichment

Updated: 2026-06-22T17:03:24.996Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-20T22:34:56Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')