A Joomla! Component vBizz 1.0.7 supports an unrestricted file upload via the profile_pic parameter, which allows authenticated users to upload arbitrary PHP code. Once uploaded, the attacker can access the file through the server’s uploads directory, achieving remote code execution. This flaw falls under CWE-434, and it enables compromise of confidentiality, integrity, and availability on the affected Joomla site.

The vulnerability exists in the Wdmtech vBizz component version 1.0.7 when deployed on Joomla! sites. Any installation that loads or enables this component and accepts uploads for the employee view endpoint is affected. No other product or version ranges are mentioned.

The CVSS score of 8.7 denotes a high severity flaw, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The attack requires an authenticated Joomla user who can access the employee view endpoint; the attacker submits a crafted PHP file, which the component stores and later can be executed by a web request. Although no exploit probability data is available, the existence of public exploits indicates a realistic threat. The lack of a KEV listing suggests the vulnerability has not yet been widely weaponized, but the high CVSS and published proof‑of‑concept code warrant immediate attention.