Design/Logic Flaw

JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension...

CVE-2015-7338

The CVE refers to an SQL Injection in the AcyMailing Joomla Component prior to version 4.9.5, triggered by an exportgeolocorder parameter in a geolocation_longitude request to index.php. The vulnerability affects the component used within Joomla installations and can allow an attacker to manipula...

CVE-2015-7338

SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...

CVE-2015-7339

CVE-2015-7339 affects JCE Joomla Component (versions 2.5.0–2.5.2). The flaw lets an attacker upload arbitrary files by crafting an image file with a .php extension to the /com_jce/editor/libraries/classes/browser.php script, enabling potential code execution or server compromise as implied by arb...

CVE-2015-7339

JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /comjce/editor/libraries/classes/browser.php script...

CVE-2015-7340

JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action...

CVE-2015-7340

The CVE-2015-7340 entry concerns the JEvents Joomla Component prior to version 3.4.0 RC6, which is reported to be vulnerable to SQL Injection via the evid parameter in the Manage Events action. The vulnerability stems from an input vector in the Manage Events workflow that allows an attacker to i...

CVE-2015-7341

CVE-2015-7341 affects the JNews Joomla Component prior to 8.5.0. The issue enables arbitrary file upload via Subscribers or Templates, demonstrated by the .php5 extension, potentially allowing upload of PHP files. Affected product: JNews Joomla Component (versions before 8.5.0). Root cause: impro...

CVE-2015-7341

JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension...

CVE-2015-7342

JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field...

CVE-2015-7342

CVE-2015-7342 affects the JNews Joomla Component prior to 8.5.0. It allows SQL injection via multiple vectors: upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field. The available connected documents confirm the affected product and inputs, but do not provide...

CVE-2015-7344

HikaShop Joomla Component before 2.6.0 has XSS via an injected payload/caption...

CVE-2015-7343

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter...

Design/Logic Flaw

HikaShop Joomla Component before 2.6.0 has XSS via an injected payload/caption...

Code injection

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter...

CVE-2015-7343

The CVE-2015-7343 entry applies to the JNews Joomla Component prior to version 8.5.0, which is vulnerable to cross-site scripting (XSS) via the mailingsearch parameter. The connected documents confirm the vulnerable component and condition, but do not provide details on root cause, affected subco...

CVE-2015-7343

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter...

CVE-2015-7344

CVE-2015-7344 concerns the HikaShop Joomla Component prior to 2.6.0, where an XSS vulnerability exists via an injected payload in the affected component. The available connected sources confirm the vulnerability is an XSS issue but do not provide specific exploit details, affected versions beyond...

CVE-2015-7344

HikaShop Joomla Component before 2.6.0 has XSS via an injected payload/caption...

Creative Contact Form extension path traversal vulnerability

Creative Contact Form is a responsive jQuery contact form for Joomla! A path traversal vulnerability exists in the helpers/mailer.php file in the Creative Contact Form extension version 4.6.2 for Joomla! prior to 2019-12-03. The vulnerability stems from a failure of a networked system or product ...