Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2019-25760

CVE-2019-25760MEDIUM

Joomtech Easy Shop — Joomla! Component Easy Shop 1.2.3 Local File Inclusion

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   N   N   H   N   N    6.9   .0045   37.1     —

AFFECTED
  Product    Versions  Fixed
  Easy Shop  1.2.3 –   —

TIMELINE
  Jun 19  Reserved by VulnCheck
  Jun 19  Published (CNA: VulnCheck)
  Aug 21  EXPLOIT PUBLISHED — CVE-2019-25760 (Joomtech Easy Shop). Public exploit reference added.

CWE-98 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to com_easyshop, task set to ajax.loadImage, and a base64-encoded file path in the file parameter to retrieve sensitive files like configuration.php and system files.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 19, 2026	Reserved	Reserved by VulnCheck
June 19, 2026	Published	Published (CNA: VulnCheck)
August 21, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2019-25760 (Joomtech Easy Shop). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Joomtech	Easy Shop	—	1.2.3	—

Weaknesses

CWE-98

References (4)

https://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/easy-shop/ [product]
https://joomtech.net/ [product]
https://www.exploit-db.com/exploits/46219 [exploit]
https://www.vulncheck.com/advisories/joomla-component-easy-shop-local-file-inclusion [third-party-advisory]

Authoritative record: CVE-2019-25760 at cve.org

Vendors: joomtech

Weaknesses: CWE-98

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-25760 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.