CVE-2018-25433: Joomla JE Photo Gallery 1.1 SQL Injection via categoryid

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-01 · updated 2026-07-22
Weakness: CWE-89

Description

Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting malicious SQL code through the categoryid parameter. Attackers can send GET requests to index.php with crafted categoryid values in the com_jephotogallery component to execute arbitrary SQL queries and retrieve sensitive data like usernames and password hashes.

Affected products

Joomlaextensions JE Photo Gallery: 1.1

References

http://joomlaextensions.co.in/download/1387375463_JE%20PhotoGallery%20(%20J-%203.0%20).zip
https://joomlaextensions.co.in
https://www.exploit-db.com/exploits/45930
https://www.vulncheck.com/advisories/joomla-je-photo-gallery-sql-injection-via-categoryid

Get alerted when CVE-2018-25433 or the next vulnerability affects your stack