CVE-2024-22497

2024-01-2319:15:08

Google

osv.dev

cross site scripting

arbitrary code

crafted url

jfinalcms 5.0.0

6.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.6%

JSON

Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.

CPENameOperatorVersion
jfinal_cmseq4.1.5
jfinal_cmseq1.2
jfinal_cmseq1.4.1
jfinal_cmseq3.1.0
jfinal_cmseq4.3.0
jfinal_cmseq4.2.0
jfinal_cmseq4.4.0
jfinal_cmseq5.0.0
jfinal_cmseq1.4
jfinal_cmseq2.1.1

Name	Operator	Version
jfinal_cms	eq	4.1.5
jfinal_cms	eq	1.2
jfinal_cms	eq	1.4.1
jfinal_cms	eq	3.1.0
jfinal_cms	eq	4.3.0
jfinal_cms	eq	4.2.0
jfinal_cms	eq	4.4.0
jfinal_cms	eq	5.0.0
jfinal_cms	eq	1.4
jfinal_cms	eq	2.1.1