TI-2017-14336 CVE-2017-20272 · GHSA-fr59-fqc2-p944Joomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_idPriority HIGH 77Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the sf_selectuser_id parameter.CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00294 · Published 2026-06-19 · No fix listed CWE-89