GCVE - cpe:2.3:a:virtuemart:virtuemart:*:*:*:*:*:joomla\!:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:virtuemart:virtuemart:*:*:*:*:*:joomla\!:*:*

part: a version: * update: *

Vendor	Virtuemart (`6fddb4da-0a7a-5032-b6bc-21299a7988b0`)
Product	Virtuemart (`8a5a8119-c32b-520c-9100-d6afc8ae9ac1`)
Edition	*
Language	*
Software edition	*
Target software	joomla!
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-25228`	vulnerable	2026-06-08 07:12:50.868643	Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend. Published: 2025-04-21T07:16:45.498Z Updated: 2025-05-07T04:36:46.068Z Open on db.gcve.eu Reference links https://virtuemart.net/ https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-25228	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-7465`	vulnerable	2026-06-08 05:12:03.716219	Details available An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS. Published: 2018-04-26T19:00:00.000Z Updated: 2024-08-05T06:24:12.042Z Open on db.gcve.eu Reference links https://imgur.com/a/Hf6JD https://www.exploit-db.com/exploits/44625/ http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handling	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3619`	vulnerable	2026-06-08 05:06:38.391536	Details available Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of first_name, last_name and company." Published: 2018-02-06T16:00:00.000Z Updated: 2024-08-06T05:47:57.898Z Open on db.gcve.eu Reference links http://dev.virtuemart.net/projects/virtuemart/repository/diff/trunk/virtuemart/administrator/components/com_virtuemart/assets/js/vm2admin.js?utf8=%E2%9C%93&rev=8828&rev_to=8670 https://virtuemart.net/news/470-release-vm3-0-8-2-secured-by-fortinet-s-fortiguard-labs https://fortiguard.com/zeroday/FG-VD-15-027	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.