CVE-2025-40636: Mod Vvisit Counter

Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisitcounter’ cookie at all endpoints where the plugin counts visits.

Affected products

• Mod Vvisit Counter Mod Vvisit Counter: version 2.0.4j3 only

Published 2025-10-03. Last modified 2026-06-17.