CVE WatchJul 21, 2026

CVE-2017-20249

Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by

CVSS

8.2

High

EPSS

0.3%

p22

KEV

—

Exploit Today

0-100

Published: Jun 9, 2026 · Last modified: Jul 21, 2026 · CWE-89

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-08-102026-09-07

Technical description

Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the albid parameter. Attackers can send GET requests with crafted SQL payloads in the albid parameter to extract sensitive database information including user credentials and authentication hashes.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-697168.8 HIG

—

———Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.1h CVE-2026-696366.5 MED

—

———Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.1h CVE-2026-673708.8 HIG

—

———Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.1h CVE-2026-668208.8 HIG

—

———Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.1h CVE-2026-668198.8 HIG

—

———Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.1h CVE-2026-628958.8 HIG

—

———Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.1h