CVE-2019-25751

Joomla J-ClassifiedsManager 3.0.5 SQL Injection

Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the categorySearch, adType, and citySearch parameters to the displayads component to extract sensitive database information including usernames, databases, and version details.

Affected

Cmsjunkie · ClassifiedsManager

CVSS v4.0 VULNCHECK

8.8 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 41st percentile

Published

2026-06-19

Updated

2026-07-15

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/46231

Security advisories

• https://www.vulncheck.com/advisories/joomla-j-classifiedsmanager-sql-injection
• http://cmsjunkie.com
• https://extensions.joomla.org/extensions/extension/ads-a-affiliates/classified-ads/j-clas…

References

• CVE Record
• NVD entry