The vAccount component 2.0.2 for Joomla! contains an SQL injection flaw that is triggered by the "vid" query parameter in the vaccount-dashboard/expense endpoint. An attacker can craft a GET request with malicious SQL code and, because the component does not require authentication, the database server will execute the payload. This allows the attacker to retrieve sensitive information such as the database name and other data stored in the same database. The vulnerability is an instance of SQL Injection (CWE‑89).

The affected product is the vAccount component developed by Wdmtech, specifically the 2.0.2 release. Any Joomla! installation that has not upgraded beyond that version is vulnerable.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, so the exact probability cannot be quantified. The flaw is exploitable remotely via an unauthenticated HTTP GET request, making it accessible to attackers who can reach the exposed endpoint. The vulnerability is not listed in CISA KEV, but its remote nature and potential for data exfiltration impose a serious risk.