Joomla! Component JoomProject 1.1.3.2 Information Disclosure

Published 4 mo ago 2026-06-19 · modified 2 mo ago 2026-08-21 · JSON

CVSS

7.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.7%

percentile 52%

Public exploits

none known

Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: partial
Assessed: 4 mo ago 2026-06-22

Exploit prediction (EPSS)

0.66% probability of exploitation in the next 30 days, higher than 52% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	8.7	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
CNA	4.0	8.7	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected products

Joomboost JoomProject

Classification

Weakness

CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

References

exploit-db.com /exploits/46121 · exploit
joomboost.com / · product
extensions.joomla.org /extensions/extension/clients-a-communities/project-a-task-management/joomproject/ · product
vulncheck.com /advisories/joomla-component-joomproject-information-disclosure · third-party-advisory

Sources

CVE List: CVE-2019-25762
NVD: CVE-2019-25762

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary