CVE-2025-40636 — SQL injection in the mod_vvisit_counter module

CVE-2025-40636

SQL injection in the mod_vvisit_counter module PUBLISHED

Description (CNA)

SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisitcounter’ cookie at all endpoints where the plugin counts visits.

Affected (CNA)

Vendor / product	Versions
mod_vvisit_counter / mod_vvisit_counter	affected 2.0.4j3

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-modvvisitcounter-module

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.