CVE-2025-25228: Virtuemart

Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend.

Affected products

• Virtuemart Virtuemart: from 1.0.0, up to and including 4.4.7

Published 2025-04-21. Last modified 2026-06-17.