CVE-2018-25348

8.8 highEPSS 0.4%

Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send GET requests to the user_detail view with malicious cid values containing SQL commands to extract sensitive database information.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-05-23
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://extensions.joomla.org/extension/ek-rishta/
https://www.exploit-db.com/exploits/44869
https://www.joomlaextensions.co.in/
https://www.vulncheck.com/advisories/joomla-component-ek-rishta-sql-injection-via-user-detail

Check your stack JSON