CVE-2025-22205

HighCVSS 7.5/10Last modified Jul 5, 2026

Description

Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 4, 2025
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-222064.7A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execut CVE-2025-222076.7Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.CVE-2025-222084.7A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execut CVE-2025-222094.7A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execut CVE-2025-22217.5The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and in CVE-2025-222107.2A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to ex CVE-2025-222113.4A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) t CVE-2025-222122.7A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (adminis CVE-2025-222137.1Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php CVE-2025-222144.3Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.CVE-2025-222154.3VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to A CVE-2025-222165.4A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated agai