CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24342 – JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24342
The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. El tema de WordPress JNews versiones anteriores a 8.0.6, no saneaba el parámetro cat_id en una petición POST/?ajax-request=jnews (with action=jnews_build_mega_category_*), conllevando a un problema de tipo Cross-Site Scripting (XSS) Reflejado • https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-7341
https://notcve.org/view.php?id=CVE-2015-7341
JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension. El componente JNews Joomla versiones anteriores a 8.5.0, permite una Carga Útil de Archivos arbitraria por medio de Subscribers or Templates, como es demostrado por una extensión .php5. • https://labs.integrity.pt/advisories/cve-2015-7341 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2015-7342
https://notcve.org/view.php?id=CVE-2015-7342
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field. El componente JNews Joomla versiones anteriores a 8.5.0, permite una inyección SQL por medio de una carga thumnail, en un Campo de Búsqueda Queue, en un Campo de Búsqueda Subscribers o en un Campo de Búsqueda Newsletters. • https://labs.integrity.pt/advisories/cve-2015-7342 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-7343
https://notcve.org/view.php?id=CVE-2015-7343
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter. JNews Joomla Component versiones anteriores a 8.5.0, presenta una vulnerabilidad de tipo XSS por medio del parámetro mailingsearch. • https://labs.integrity.pt/advisories/cve-2015-7343 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •