CVE-2025-50127

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands.

Metrics

CVSS 4.0 8.5/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 23, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-501286.1A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev masteCVE-2025-501298.8A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decoding thCVE-2025-50134.7A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /indexCVE-2025-501307.8A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD. Opening VCVE-2025-50148.8The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valCVE-2025-50158.8A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS CVE-2025-501518.8File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena versCVE-2025-501527.8Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-501537.8Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally.CVE-2025-501546.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing overCVE-2025-501557.8Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileCVE-2025-501565.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over
CVE-2025-50127: High severity, CVSS 8.5 | Vulnix