BaseFortify

Publication date: 2025-10-28

Last updated on: 2025-10-30

Assigner: Joomla! Project

Description

Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-28

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-28

EPSS Evaluated

2026-07-05

NVD

CVE-2025-55758

EUVD

EUVD-2025-36444

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	joomla	*
jdownloads	jdownloads	*
jdownloads	jdownloads	4.0.48

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves multiple Cross-Site Request Forgery (CSRF) attack vectors in the JDownloads component versions 1.0.0 to 4.0.47 for Joomla. CSRF attacks trick authenticated users into submitting unwanted actions on a web application in which they are currently authenticated.

Impact Analysis

An attacker could exploit these CSRF vulnerabilities to perform unauthorized actions on behalf of an authenticated user, potentially leading to unauthorized changes or data manipulation within the Joomla site using the JDownloads component.

Hi! I’m here to help you understand CVE-2025-55758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70