PT-2026-50994 · Joomla · Vbizz

Ihsan Sencan · CVE-2019-25758 · Published 2026-06-19 · Updated 2026-06-22

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! Component vBizz version 1.0.7

Description An unrestricted file upload issue allows authenticated attackers to upload arbitrary PHP files. This is achieved by submitting malicious files through the profile pic parameter via POST requests to the 'employee view' endpoint. Once uploaded to the uploads directory, these files can be executed to achieve remote code execution, which is the ability to run arbitrary commands on the target server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-25758

Affected Products

Vbizz

References · 8

• 🔥 https://exploit-db.com/exploits/46224 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25758 · Security Note
• https://extensions.joomla.org/extensions/extension/marketing/crm/vbizz · Note
• https://t.me/CVEtracker/57400 · Telegram Post
• https://t.me/cveNotify/171163 · Telegram Post
• http://wdmtech.com · Note
• https://vulncheck.com/advisories/joomla-component-vbizz-remote-code-execution · Note
• https://t.me/cveNotify/171872 · Telegram Post