Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-7342: JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.

CVE-2015-7342 · published 6 years ago

Summary

JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.

What to do

Update joobi jnews to version 8.5.0 or later.

Affected software

Vendor	Product	Affected versions
joobi	jnews	< 8.5.0 `cpe:2.3:a:joobi:jnews::::::joomla\!::*`

Original advisory text

JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.

References

https://labs.integrity.pt/advisories/cve-2015-7342/ Exploit Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published9 Mar 2020

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-7342 · NVD

Track software like this

Free during beta