Is CVE-2019-25756 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25756 being exploited in the wild.

How severe is CVE-2019-25756?

High severity, with a CVSS score of 8.2, published 19 June 2026.

Is there a fix for CVE-2019-25756?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25756 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-25756?

Check whether you run Wdmtech vAccount at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25756: Wdmtech vAccount SQL injection in vaccount-dashboard

CVE-2019-25756 · Severity: high · CVSS 8.2 · Published 2026-06-19

vAccount is an accounting and financial management extension for the Joomla content management system. A security flaw in this component allows unauthorized individuals to access and extract sensitive information from the website's database. This could lead to the exposure of financial records, customer data, and technical details about the server's configuration.

Vendors: Wdmtech.

Quick answers

Is CVE-2019-25756 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25756 being exploited in the wild.
How severe is CVE-2019-25756?: High severity, with a CVSS score of 8.2, published 19 June 2026.
Which products and versions are affected?: Wdmtech vAccount 2.0.2.
Is there a fix for CVE-2019-25756?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25756 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-25756?: Check whether you run Wdmtech vAccount at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in the vAccount component (version 2.0.2) for Joomla. The flaw is located within the 'vid' parameter of the 'vaccount-dashboard/expense' endpoint. An unauthenticated remote attacker can exploit this by sending specially crafted GET requests containing malicious SQL payloads. Successful exploitation allows the attacker to execute arbitrary SQL commands, enabling the extraction of sensitive database information such as database names, versions, and potentially administrative credentials or financial data. The vulnerability is classified as CWE-89.

Affected products

Wdmtech vAccount 2.0.2

Timeline

2026-06-19: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.