{"id":"CVE-2025-49467","state":"PUBLISHED","title":"Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla","description":"A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.","publishedAt":"2025-06-12T15:18:32.804Z","updatedAt":"2025-06-12T15:52:20.609Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:Amber","source":"Joomla"},"assigner":"Joomla","products":["jevents.net / GWE Systems Ltd JEvents component for Joomla"],"affected":[{"vendor":"jevents.net / GWE Systems Ltd","product":"JEvents component for Joomla","packageName":"com_jevents","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.6.82","status":"affected"},{"version":"3.6.82.1","status":"unaffected"},{"version":"3.6.83-3.6.87","status":"affected"}]}],"references":["https://jevents.net/"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/49xxx/CVE-2025-49467.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-49467","state":"PUBLISHED","datePublished":"2025-06-12T15:18:32.804Z","dateUpdated":"2025-06-12T15:52:20.609Z","assignerShortName":"Joomla","assignerOrgId":"6ff30186-7fb7-4ad9-be33-533e7b05e586","dateReserved":"2025-06-05T04:37:35.548Z"},"containers":{"cna":{"title":"Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla","descriptions":[{"lang":"en","value":"A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges."}],"affected":[{"vendor":"jevents.net / GWE Systems Ltd","product":"JEvents component for Joomla","packageName":"com_jevents","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.6.82","status":"affected"},{"version":"3.6.82.1","status":"unaffected"},{"version":"3.6.83-3.6.87","status":"affected"}]}],"references":[{"url":"https://jevents.net/","tags":["product"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:Amber"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Joomla","orgId":"6ff30186-7fb7-4ad9-be33-533e7b05e586","dateUpdated":"2025-06-12T15:52:20.609Z"},"credits":[{"lang":"en","type":"finder","value":"José Apari Pantigozo"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-12T15:35:18.652604Z","id":"CVE-2025-49467","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-12T15:35:30.138Z"}}]}}}