Loading product vulnerabilities…
Total
3
Critical
0
High
2
Medium
1
CISA KEV
0
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.