{"id":"CVE-2017-20269","state":"PUBLISHED","title":"Joomla! Component KissGallery 1.0.0 SQL Injection","description":"Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component URL path. Attackers can supply malicious SQL code in the kissgallery endpoint to execute arbitrary database queries and extract sensitive information.","publishedAt":"2026-06-19T16:14:34.172Z","updatedAt":"2026-06-22T16:47:42.502Z","severity":{"score":8.8,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Terrywcarter KissGallery"],"affected":[{"vendor":"Terrywcarter","product":"KissGallery","versions":[{"version":"1.0.0","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/42494","http://terrywcarter.com/","https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/kissgallery/","https://www.vulncheck.com/advisories/joomla-component-kissgallery-sql-injection"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:43:37.076Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2017/20xxx/CVE-2017-20269.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2017-20269","state":"PUBLISHED","datePublished":"2026-06-19T16:14:34.172Z","dateUpdated":"2026-06-22T16:47:42.502Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-06-19T15:06:16.316Z"},"containers":{"cna":{"title":"Joomla! Component KissGallery 1.0.0 SQL Injection","descriptions":[{"lang":"en","value":"Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component URL path. Attackers can supply malicious SQL code in the kissgallery endpoint to execute arbitrary database queries and extract sensitive information."}],"affected":[{"vendor":"Terrywcarter","product":"KissGallery","versions":[{"version":"1.0.0","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/42494","name":"ExploitDB-42494","tags":["exploit"]},{"url":"http://terrywcarter.com/","name":"Official Product Homepage","tags":["product"]},{"url":"https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/kissgallery/","name":"Product Reference","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/joomla-component-kissgallery-sql-injection","name":"VulnCheck Advisory: Joomla! Component KissGallery 1.0.0 SQL Injection","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.8,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-06-19T16:14:34.172Z"},"datePublic":"2017-08-18T00:00:00.000Z","credits":[{"lang":"en","value":"Ihsan Sencan","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-22T16:46:48.317968Z","id":"CVE-2017-20269","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-22T16:47:42.502Z"}}]}}}