Jfinal Cms Security Vulnerabilities

CVE-2023-47503

An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management...

CVE-2023-34645

jfinal CMS 5.1.0 has an arbitrary file read...

CVE-2023-30349

JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter...

CVE-2023-24747

Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component...

CVE-2023-22975

A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under...

CVE-2022-37202

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-37208

JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL...

CVE-2022-37209

JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL...

CVE-2022-37205

JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL...

CVE-2022-37204

Final CMS 5.1.0 is vulnerable to SQL...

CVE-2022-37203

JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL...

CVE-2022-37201

JFinal CMS 5.1.0 is vulnerable to SQL...

CVE-2022-37207

JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL...

CVE-2022-38281

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38286

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38276

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38279

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38272

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38282

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38277

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38283

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38284

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38273

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38274

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38280

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38278

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38275

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-38285

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-36527

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog...

CVE-2022-37223

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-37199

JFinal CMS 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-34928

JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via...

CVE-2022-33113

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog...

CVE-2022-33114

Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at...

CVE-2022-29648

A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For...

CVE-2022-30500

Jfinal cms 5.1.0 is vulnerable to SQL...

CVE-2021-42242

A command execution vulnerability exists in jfinal_cms 5.0.1 via...

CVE-2022-28505

Jfinal_cms 5.1.0 is vulnerable to SQL Injection via...

CVE-2022-27111

Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute...

CVE-2021-46087

In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious...

CVE-2021-37262

JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of...

CVE-2021-40639

Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via...

CVE-2020-19150

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component...

CVE-2020-19154

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component...

CVE-2020-19146

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component...

CVE-2020-19148

Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component...

CVE-2020-19151

Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component...

CVE-2020-19155

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component...

CVE-2020-19147

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component...