CVE Watch21 jul 2026

CVE-2017-20249

Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by

CVSS

8.2

Alto

EPSS

0.3%

p22

KEV

—

Exploit Today

0-100

Publicado: 9 jun 2026 · Última mod.: 21 jul 2026 · CWE-89

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-08-102026-09-07

Descripción técnica

Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the albid parameter. Attackers can send GET requests with crafted SQL payloads in the albid parameter to extract sensitive database information including user credentials and authentication hashes.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-697168.8 ALT

—

———Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.2h CVE-2026-696366.5 MED

—

———Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.2h CVE-2026-673708.8 ALT

—

———Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.2h CVE-2026-668208.8 ALT

—

———Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.2h CVE-2026-668198.8 ALT

—

———Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.2h CVE-2026-628958.8 ALT

—

———Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.2h