CVE-2015-7342

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://labs.integrity.pt/advisories/cve-2015-7342/Exploit, Third Party Advisory
https://labs.integrity.pt/advisories/cve-2015-7342/Exploit, Third Party Advisory

Timeline

Published: Mar 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-73434.8JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.CVE-2015-73444.8HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].CVE-2015-73469.8SQL injection vulnerability in ZCMS 1.1.CVE-2015-73474.8Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.CVE-2015-73484.3Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HT CVE-2015-73496.1Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface a CVE-2015-73576.1Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to in CVE-2015-73587.8The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, doe CVE-2015-73597.8The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, w CVE-2015-73606.1Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attac CVE-2015-73619.3FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authenticat CVE-2015-73627.8Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allo