Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Joomla Component Myportfolio SQL Injection Risk: Unauthorized Data Access

CVE-2017-20280 · published 4 months ago
Summary

An attacker can access sensitive database information without permission by manipulating a parameter in a URL. This can happen when an attacker sends a malicious request to the Myportfolio component in Joomla. To protect against this, update to the latest version of Myportfolio or consider disabling the component if it's not essential to your site.

Original advisory text
Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Atta...
Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Attackers can send GET requests to index.php with malicious pid values in the task=project&view=grid endpoint to extract sensitive database information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published19 Jun 2026
Updated4 Nov 2026
First seen19 Jun 2026
Sources
CVE-2017-20280 · NVD
Track software like this
Free during beta