PT-2026-50937 · Undefined · Undefined

Published 2026-06-19 · Updated 2026-06-19 · CVE-2017-20260

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product id parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the product id parameter to extract sensitive database information including credentials and configuration data.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-20260

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-20260 · Security Note
• https://vulncheck.com/advisories/joomla-component-price-alert-sql-injection · Note
• https://extensions.joomla.org/extensions/extension/extension-specific/virtuemart-extensions/price-alert · Note
• https://weborange.eu · Note
• https://exploit-db.com/exploits/42553 · Note