CVE-2017-20276

Joomla! Component SIMGenealogy 2.1.5 SQL Injection

No known exploitation. EPSS puts it in the 35th percentile. No fix published yet.

CVSS 3.18.2High EPSS percentile35th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-06-19Updated 2026-08-19Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Simbunch SIMGenealogyAffected: 2.1.5Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Joomla! site has SIMGenealogy installed and whether its version is 2.1.5.
If it is version 2.1.5, remove or disable the component until your vendor provides a verified fixed release.
There is no confirmed fixed version available; ask the component vendor for its replacement or remediation guidance.
Review website and database access records for unusual requests to the component, especially requests containing unexpected database-query text.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the type parameter. Attackers can send GET requests to index.php with the option=com_simgenealogy, view=latest parameters and inject malicious SQL in the type parameter to extract sensitive database information.

In plain language

Written by AI from the record

SIMGenealogy 2.1.5 has a flaw that can let an outsider steal website database information, so small businesses using that version should act now.

Unauthenticated SQL injection in SIMGenealogy 2.1.5 allows database-query manipulation through an HTTP GET request’s `type` parameter.

If you're affected

Website database data theft
Customer record exposure
Sensitive information disclosure

What is it

This is a weakness in a website add-on that can let a stranger ask the site’s database questions it was never meant to answer. It is like someone slipping extra questions into a receptionist’s request form and receiving files they should not be allowed to see.

Who is affected

This matters to you if your Joomla! website uses SIMGenealogy version 2.1.5. It is a risk when the affected component is reachable from the internet.

How urgent is it

An attacker does not need an account or help from a staff member to attempt data theft, which makes this an amber-priority issue. It is not listed in CISA’s known-exploited catalog and no public exploit code is on record, but internet-facing installations should be checked and contained promptly.

What to do — in detail

Confirm whether SIMGenealogy 2.1.5 is installed on any Joomla! server and whether its public site can receive requests to the component. No vendor patch or fixed version is available in the findings, so there is no supported upgrade target to provide. If removal is not immediately possible, disable the component or restrict public access to it until the vendor supplies a verified remediation or replacement path.

There is no CISA KEV due date because this CVE is not listed in KEV. Review web-server logs for requests to index.php involving option=com_simgenealogy, view=latest, or unusual values in type; also investigate unexpected database reads or exported data.

Technical context

CVE-2017-20276 is rated CVSS 8.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). It is CWE-89 SQL injection via the type parameter in a network-accessible HTTP GET request, with no authentication or user interaction required, and the component is reachable in the default configuration. CISA KEV does not list it, no public exploit code is recorded, and EPSS is 0.4% (37th percentile) with a flat trend. Press attention is sustained.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS35th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 35th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 61 days, from the signal feeds we watch.

2026-08-19Record updated
2026-06-22Record updated
2026-06-19Publishedweakness classified, att&ck mapped

Affected products

Simbunchcommercial
- SIMGenealogyConsumer Software / productivity

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Scored 8.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact