CVE-2019-25760

MediumCVSS 5.5/10Last modified Aug 21, 2026

Description

Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to com_easyshop, task set to ajax.loadImage, and a base64-encoded file path in the file parameter to retrieve sensitive files like configuration.php and system files.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-98

Affected software

Vendor	Product	Versions
Joomtech	Easy Shop	1.2.3

References

https://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/easy-shop/Product
https://joomtech.net/Product, Broken Link
https://www.exploit-db.com/exploits/46219Exploit, VDB Entry
https://www.vulncheck.com/advisories/joomla-component-easy-shop-local-file-inclusionThird Party Advisory

Timeline

Published: Jun 19, 2026
Last modified: Aug 21, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-257617.1Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries CVE-2019-257627.5Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensi CVE-2019-257639.8WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthori CVE-2019-257647.3**UNSUPPORTED WHEN ASSIGNED** Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the CVE-2019-257657.5ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitr CVE-2019-257667.5Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update fai CVE-2019-25773.3Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite (subcomponent: File Locking Services). The supported vers CVE-2019-257767.5Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by sub CVE-2019-257777.3YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code e CVE-2019-257788.2SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by in CVE-2019-257797.5WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the CVE-2019-25788.6Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is