SQL Injection Vulnerability in JEvents Component for Joomla

CVE-2025-49467

What is CVE-2025-49467?

A SQL injection vulnerability exists in the JEvents component prior to version 3.6.88 and version 3.6.82.1. This security flaw allows an attacker to exploit publicly accessible actions for retrieving event listings by specified date ranges. If successful, the attacker could manipulate SQL queries to access or modify the underlying database, leading to unauthorized information disclosure or data corruption. It is critical for users of the JEvents component to ensure they are using the updated versions to mitigate these risks.

References