---
id: CVE-2017-20252
title: Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter
summary: >-
  Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that
  allows unauthenticated attackers to execute arbitrary SQL commands through the
  plname parameter. Attackers can send GET requests to index.php with
  option=com_nge&vi…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: nextgeneditor
product: NextGen Editor
affected:
  - nextgen_editor 2.1.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-22T16:27:30.608915Z'
exploitAvailable: true
published: '2026-06-19'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T00:40:46.876Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2017-20252'
references:
  - url: 'https://www.exploit-db.com/exploits/43365'
    label: ExploitDB-43365
  - url: 'https://extensions.joomla.org/extension/nextgen-editor/'
    label: Product Reference
  - url: >-
      https://www.vulncheck.com/advisories/joomla-nextgen-editor-sql-injection-via-plname-parameter
    label: >-
      VulnCheck Advisory: Joomla NextGen Editor 2.1.0 SQL Injection via plname
      Parameter
tags:
  - cve.org
  - exploit-available
epss: 0.00476
epssPercentile: 0.40947
ingestedAt: '2026-10-27T16:11:59.190Z'
---

## Overview

Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the plname parameter. Attackers can send GET requests to index.php with option=com_nge&view=config and inject malicious SQL code in the plname parameter to extract sensitive database information.

## Affected

- `nextgen_editor 2.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.