CVE-2017-20260CWE-89sql-injection

CVE-2017-20260

High · published June 19, 2026

CVSS v3.1

8.2

EPSS

Percentile

41.4

In the wild

Unconfirmed

What it is

Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the product_id parameter to extract sensitive database information including credentials and configuration data.

The record

Technical detail

CVSS v3.1: 8.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00492 · 41.4th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-06-19T20:16Z

Affected products (1)

Product	Versions	Fixed in
weborange/price_alert	all versions	—

References (4)

https://extensions.joomla.org/extensions/extension/extension-specific/virtuemart-extensions/price-alert/ · [email protected]https://www.exploit-db.com/exploits/42553 · [email protected]https://www.vulncheck.com/advisories/joomla-component-price-alert-sql-injection · [email protected]https://www.weborange.eu/ · [email protected]

EPSS history

Timeline

19 JUN 15:44Z
Joomla! Component Price Alert 3.0.2 SQL Injection
cvelistv5