CVE-2015-7339

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/libraries/classes/browser.php script.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-73407.2JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.CVE-2015-73418.8JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.CVE-2015-73427.2JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters CVE-2015-73434.8JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.CVE-2015-73444.8HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].CVE-2015-73469.8SQL injection vulnerability in ZCMS 1.1.CVE-2015-73474.8Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.CVE-2015-73484.3Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTCVE-2015-73496.1Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface aCVE-2015-73576.1Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inCVE-2015-73587.8The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, doeCVE-2015-73597.8The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, w
CVE-2015-7339: High severity, CVSS 8.8 | Vulnix