SQL Injection in Mod Vvisit Counter
CVE-2025-40636
SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisitcounter’ cookie at all endpoints where the plugin counts visits.
Vulnerability class: SQL Injection
EPSS: 0.003 (19.4th percentile) — read the EPSS interpretation.
Affected products
- Mod_vvisit_counter — versions 2.0.4j3