What is the CVSS score of CVE-2025-49467?

CVE-2025-49467 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:Amber. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-49467?

A critical SQL injection vulnerability in the JEvents Joomla component allows unauthenticated attackers to execute arbitrary database queries through publicly accessible event listing features.

How to fix or mitigate CVE-2025-49467?

Within 24 hours: Identify all Joomla instances running JEvents versions 3.6.88 or earlier and 3.6.82.1; disable the JEvents component or restrict public access to event listing functionality. Within 7 days: Implement WAF rules to block SQL injection patterns targeting JEvents date range parameters; conduct database audit for unauthorized access. Within 30 days: Upgrade JEvents to a patched version when available; perform comprehensive security assessment and penetration testing of affected systems.

PHP CVE-2025-49467

EUVD-2025-18196 CRITICAL

SQL Injection (CWE-89)

2025-06-12 security@joomla.org

SQLi Joomla PHP

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:20 euvd

EUVD-2025-18196

Analysis Generated

Mar 14, 2026 - 21:20 vuln.today

CVE Published

Jun 12, 2025 - 16:15 nvd

CRITICAL 9.3

DescriptionCVE.org

A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.

AnalysisAI

Critical unauthenticated SQL injection vulnerability in the JEvents component for Joomla that allows remote attackers to execute arbitrary SQL queries through publicly accessible date range filtering actions. The vulnerability affects JEvents versions before 3.6.88 and 3.6.82.1, enabling attackers to extract sensitive database information, modify data, or potentially achieve remote code execution. With a CVSS score of 9.3 and network-based attack vector requiring no privileges or user interaction, this represents a severe risk to all unpatched Joomla installations using vulnerable JEvents versions.

Technical ContextAI

The JEvents component is a widely-used Joomla extension for event management and calendar functionality. The vulnerability exists in SQL query construction for event listing operations that filter events by date ranges. The root cause falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input from date range parameters is directly concatenated into SQL queries without proper parameterization or escaping. This occurs in publicly accessible actions, meaning the vulnerable code paths do not require authentication. The affected component likely uses direct database queries via Joomla's database API without utilizing prepared statements or parameterized queries, allowing attackers to inject arbitrary SQL syntax through specially crafted date parameters.

RemediationAI

Immediate actions: (1) Update JEvents component to version 3.6.89 or later (or 3.6.82.2+ if using the 3.6.82.x branch) - obtain from official JEvents website or Joomla Extensions Directory; (2) If immediate patching is not feasible, disable the JEvents component in Joomla administrator panel under Extensions > Manage > Extensions until patching is completed; (3) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to JEvents date-range parameters; (4) Review database access logs and audit trails for evidence of exploitation (unusual SQL errors, unexpected queries, unauthorized data access) dating back to component deployment; (5) Conduct database integrity verification and restoration from clean backups if exploitation is confirmed; (6) Apply principle of least privilege to Joomla database user accounts to limit damage from successful SQL injection. Vendor advisory and patches should be obtained from official JEvents sources and Joomla security announcements.