Is CVE-2019-25753 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25753 being exploited in the wild.

How severe is CVE-2019-25753?

High severity, with a CVSS score of 8.2, published 19 June 2026.

Is there a fix for CVE-2019-25753?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25753 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2019-25753?

Check whether you run Wdmtech VMap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25753: Wdmtech VMap SQL injection in loadmarker task

CVE-2019-25753 · Severity: high · CVSS 8.2 · Published 2026-06-19

Wdmtech VMap is a Joomla extension used to display database records and custom locations on Google Maps. A security flaw allows unauthorized individuals to run malicious database commands by sending a specially crafted web request. This could lead to the theft of sensitive information stored in the website's database, potentially compromising user data or site configuration.

Vendors: Wdmtech.

Quick answers

Is CVE-2019-25753 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25753 being exploited in the wild.
How severe is CVE-2019-25753?: High severity, with a CVSS score of 8.2, published 19 June 2026.
Which products and versions are affected?: Wdmtech VMap 1.9.6.
Is there a fix for CVE-2019-25753?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25753 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2019-25753?: Check whether you run Wdmtech VMap at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in the VMap component (com_vmap) for Joomla, specifically within the 'loadmarker' task. The issue stems from improper neutralization of the 'latlngbound' parameter in GET requests sent to index.php. An unauthenticated remote attacker can exploit this by submitting malicious SQL payloads to manipulate backend database queries. Successful exploitation allows for unauthorized data extraction from the Joomla database. While the advisory focuses on version 1.9.6, later versions are available (e.g., 1.11.1), and users should verify if the fix is present in current releases.

Affected products

Wdmtech VMap 1.9.6

Timeline

2026-06-19: advisory: NVD and VulnCheck published the vulnerability details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.