CVE-2019-25760
Joomla! Component Easy Shop 1.2.3 Local File Inclusion
CVSS Score
6.2
EPSS Score
0.0%
EPSS Percentile
0th
Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to com_easyshop, task set to ajax.loadImage, and a base64-encoded file path in the file parameter to retrieve sensitive files like configuration.php and system files.
| CWE | CWE-98 |
| Vendor | joomtech |
| Product | easy shop |
| Published | Jun 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for joomtech easy shop
Be the first to know when new medium vulnerabilities affecting joomtech easy shop are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Joomtech / Easy Shop
1.2.3
References
exploit-db.com: https://www.exploit-db.com/exploits/46219 joomtech.net: https://joomtech.net/ extensions.joomla.org: https://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/easy-shop/ vulncheck.com: https://www.vulncheck.com/advisories/joomla-component-easy-shop-local-file-inclusion
Credits
Ihsan Sencan