CVE-2025-22206

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
joomsky.com	JS Jobs component for Joomla	1.1.5-1.4.2

References

https://decrypt.locker/obtaining-my-first-cve/Exploit, Third Party Advisory
https://joomsky.com/js-jobs-joomla/Product

Timeline

Published: Feb 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-222076.7Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.CVE-2025-222084.7A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execut CVE-2025-222094.7A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execut CVE-2025-22217.5The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and in CVE-2025-222107.2A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to ex CVE-2025-222113.4A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) t CVE-2025-222122.7A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (adminis CVE-2025-222137.1Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php CVE-2025-222144.3Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.CVE-2025-222154.3VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to A CVE-2025-222165.4A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated agai CVE-2025-222178.6Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are availabl