What’s Vulnerable › Vulnerabilities
CVE-2025-25226: [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-04-08 · updated 2026-06-17
- Weakness: CWE-89
Description
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.
Affected products
- Joomla!: from 1.0.0 before 2.2.0; from 3.0.0 before 3.4.0 — fixed in 2.2.0, 3.4.0
How to fix
Upgrade to a fixed version: Joomla! 2.2.0, 3.4.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-25226 or the next vulnerability affects your stack