CVE-2025-22207

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.

Metrics

CVSS 4.0 6.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 18, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-222084.7A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to executCVE-2025-222094.7A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to executCVE-2025-22217.5The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and inCVE-2025-222107.2A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to exCVE-2025-222113.4A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) tCVE-2025-222122.7A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (adminisCVE-2025-222137.1Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php CVE-2025-222144.3Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.CVE-2025-222154.3VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to ACVE-2025-222165.4A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated agaiCVE-2025-222178.6Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are availablCVE-2025-222187.7VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be
CVE-2025-22207: Medium severity, CVSS 6.7 | Vulnix