PT-2026-50929 · Undefined · Undefined

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2017-20252

NVD

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the plname parameter. Attackers can send GET requests to index.php with option=com nge&view=config and inject malicious SQL code in the plname parameter to extract sensitive database information.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-20252

Produtos afetados

Undefined

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-20252 · Nota de Segurança
• https://vulncheck.com/advisories/joomla-nextgen-editor-sql-injection-via-plname-parameter · Nota
• https://extensions.joomla.org/extension/nextgen-editor · Nota
• https://exploit-db.com/exploits/43365 · Nota