Vulnerabilities

TI-2015-06105 CVE-2015-7341 · GHSA-q3vp-f397-99rf

JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or…

MEDIUM 40

JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01127 Published 2020-03-09 No fix listed CWE-434

TI-2015-06106 CVE-2015-7342 · GHSA-f7h6-pm8g-v4c4

JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue…

LOW 34

JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00982 Published 2020-03-09 No fix listed CWE-89

TI-2015-06107 CVE-2015-7343 · GHSA-xrg5-3www-67qf

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.

LOW 23

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00539 Published 2020-03-09 No fix listed CWE-79

Vulnerabilities

Filters

JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or…

JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue…

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.