My site was hacked like another user on here. I found x.php hacked my Hmei7
one file in root folder and one in images
I deleted both files, and applied patches but the next day someone registered and it crashed my Jomsocial frontpage I suppose that was another hacker.
I deleted user and jomsocial frontpage came back.

updated to latest Jomsocial
and applied admin tools

My question is I applied the latest jomsocial do I still need to apply the patch or is it included in the latest download.

I think The vulnerability is located in the 'photos' controller, 'ajaxUploadAvatar' task.

Hi,

No you dont need if you do full re-install jomsocial with the installation package.