PatchTheCVE: joobihttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2015-7342: JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribershttps://patchthecve.com/cve/CVE-2015-7342.htmlhttps://patchthecve.com/cve/CVE-2015-7342.htmlWed, 17 Jun 2026 00:32:17 +0000HIGH 7.2: JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.CVE-2015-7341: JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstratedhttps://patchthecve.com/cve/CVE-2015-7341.htmlhttps://patchthecve.com/cve/CVE-2015-7341.htmlWed, 17 Jun 2026 00:32:17 +0000HIGH 8.8: JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.CVE-2015-7343: JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.https://patchthecve.com/cve/CVE-2015-7343.htmlhttps://patchthecve.com/cve/CVE-2015-7343.htmlWed, 17 Jun 2026 00:32:17 +0000MEDIUM 4.8: JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.