CVE-2017-20260

HIGH 8.2CVE-2017-20260 · Published 19/06/2026 · updated 19/08/2026

In short

CVE-2017-20260 is a HIGH (CVSS 8.2) vulnerability affecting price alert (weborange).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
price alert weborange	`= 3.0.2`	No fix yet

Description

Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the product_id parameter to extract sensitive database information including credentials and configuration data.

References

extensions.joomla.org/extensions/extension/extension-specific/virtuemart-extensions/price-alert · Product
exploit-db.com/exploits/42553 · Exploit
vulncheck.com/advisories/joomla-component-price-alert-sql-injection · Third Party Advisory
weborange.eu · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free