1. Home
  2. CVE Database
  3. CVE-2025-25226
CRITICAL · 9.8

CVE-2025-25226

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in t...

Vulnerability Description

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
JoomlaJoomla\!>= 1.0.0, < 2.2.0

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2025-25226?

CVE-2025-25226 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in t...

How severe is CVE-2025-25226?

CVE-2025-25226 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-25226?

Check the references section above for vendor advisories and patch information. Affected products include: Joomla Joomla\!.