VulnerabilityAnalyzed

CVE-2017-20269

Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component URL path.

HIGH 8.8EPSS 0.49%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component URL path. Attackers can supply malicious SQL code in the kissgallery endpoint to execute arbitrary database queries and extract sensitive information.

CVSS 4.0: 8.8 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.49% probability · 42th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-89
Affected: terrywcarter/kissgallery
Source: disclosure@vulncheck.com

EPSS trend

EPSS 0.5% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://terrywcarter.com/Product
https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/kissgallery/Product
https://www.exploit-db.com/exploits/42494Exploit, VDB Entry
https://www.vulncheck.com/advisories/joomla-component-kissgallery-sql-injectionThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.