Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Joobi records in CISA KEVNo Joobi vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 40
JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01127 · Published 2020-03-09 · No fix listed CWE-434
Priority LOW 34
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00982 · Published 2020-03-09 · No fix listed CWE-89
Priority LOW 23
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00539 · Published 2020-03-09 · No fix listed CWE-79
