Loading story…
A high-severity SQL injection vulnerability tracked as CVE-2017-20263 affects Joomla! Component FocalPoint Pro/Free 1.2.3. Public disclosures show that unauthenticated attackers can send crafted GET requests to index.php using option=com_focalpoint, view=location, and a malicious id value to inject arbitrary SQL commands through the component’s location view. The flaw was originally publicly documented without a CVE and later cataloged as remotely exploitable with CVSS 4.0 8.8 and CVSS 3.1 8.2 ratings.
Successful exploitation could expose sensitive information stored in the backend database and may allow broader abuse depending on database permissions. Published guidance recommends updating the affected component, sanitizing the vulnerable id parameter, using parameterized queries, and limiting database account privileges to reduce impact if exploitation occurs.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Joomla! FocalPoint Pro/Free 1.2.3 SQL injection flaw is identified as CVE-2017-20263 and described as remotely exploitable by unauthenticated attackers via a crafted GET request. The advisory rates the issue high severity and notes potential exposure of sensitive database information.
A publicly disclosed SQL injection vulnerability affecting Joomla! Component FocalPoint Pro / Free 1.2.3 was documented by Ihsan Sencan. The disclosure included a proof of concept showing exploitation through the location view id parameter in index.php.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceexploit-db.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw in Joomla! tracked as **`CVE-2015-8562`** allowed unauthenticated attackers to achieve remote code execution by sending crafted HTTP headers, including **`User-Agent`**, to vulnerable sites. The bug affected Joomla! versions **`1.5.0` through `3.4.5`** and was fixed in **`3.4.6`**. Researchers reported that exploitation was already occurring in the wild before the patch was released, with attackers abusing Joomla!'s session handling to write malicious serialized data into the backend MySQL session store and trigger code execution on a follow-up request. The exploit chain relied on multiple conditions: Joomla! stored session data in MySQL text fields, MySQL could silently truncate input containing 4-byte UTF-8 characters under configurations such as **`utf8_general_ci`**, and PHP session decoding behavior associated with **`CVE-2015-6835`** could turn the truncated data into attacker-controlled objects. The injected object chain then reached Joomla! components including **`JDatabaseDriverMysqli`** and **`SimplePie`**, ultimately invoking dangerous code paths such as **`assert()`**. Recommended mitigations included upgrading Joomla! and PHP, applying distribution patches, using **`utf8mb4`** where appropriate, and enabling stricter MySQL SQL modes to prevent silent truncation.
Aug 15, 2026
A high-severity unauthenticated blind SQL injection vulnerability, tracked as **CVE-2026-57831**, was disclosed in the Joomla extension **DP Calendar** from Digital Peak. The flaw affects versions **8.18.0 through 10.11.2**, is remotely exploitable without authentication, and carries a **CVSS 4.0 score of 8.7**, creating a risk of database compromise through crafted requests against exposed installations. Advisory data recommends updating **DP Calendar** to a patched release and verifying that the update was successfully applied across affected Joomla environments. A separate Microsoft Security Update Guide entry for **CVE-2026-56155** was also published, but the available record did not provide enough technical detail to establish a related product impact, exploitation path, or mitigation guidance.
Jul 16, 2026
Attacks targeting **Joomla!** vulnerability `CVE-2023-23752` increased sharply after the flaw was disclosed and patched, with MBSD-SOC first observing exploitation attempts on February 18 and reporting a further rise through March. The bug is an improper access control issue in Joomla! webservice endpoints that affects versions `4.0.0` through `4.2.7`, allowing unauthorized API access and exposure of sensitive information; researchers warned that successful exploitation could lead to site compromise. MBSD-SOC said attack volume climbed notably after March 8 as proof-of-concept exploit code became publicly available, with most observed traffic originating from the United States and increased activity also seen from Japan and Singapore. The Joomla! Project rated the issue **Critical** and released fixes in version `4.2.8`; defenders were advised to upgrade affected systems and change passwords in the global configuration because exposed credentials and configuration data could aid follow-on compromise.
Aug 15, 2026