CVE-2019-19846: Joomla!

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

Affected products

• Joomla! Joomla!: from 2.5.0, up to and including 3.9.14

Published 2019-12-18. Last modified 2026-06-17.