CVE-2019-25750: Cmsjunkie Multiplehotelreservation

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column data.

Affected products

• Cmsjunkie Multiplehotelreservation: version 6.0.7 only

Published 2026-06-19. Last modified 2026-08-19.