Jfinalcms 安全漏洞

JFinalCMS is a content management system by heyewei individual developer. A security vulnerability exists in Jfinalcms version v.5.0.0, which stems from the presence of a cross-site scripting vulnerability that allows remote attackers to execute arbitrary code via a crafted script...

CVE-2024-33445

An issue in hisiphp v2.0.111 allows a remote attacker to execute arbitrary code via a crafted script to the SystemPlugins::mkInfo parameter in the SystemPlugins.php component...

CVE-2024-33443

An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php component...

CVE-2024-31621

FlowiseAI Inc Flowise versions prior to 1.8.1 (specifically versions 1.6.5 and before) are vulnerable to an authentication bypass and code injection . The root cause is a case-sensitivity issue where the application checks for lowercase /api/v1/ to apply authentication middleware; however, using ...

CVE-2024-33443: Improper Control of Generation of Code

An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php component...

CVE-2024-33443

The onethink content management framework (version 1.1 ) is vulnerable to arbitrary code execution . A remote attacker can exploit this issue by sending a crafted script to the AddonsController.class.php component. As of the current documentation, no patched version is available. To mitigate risk...

CVE-2023-51254

A Cross Site Scripting (XSS) vulnerability exists in Jfinalcms v.5.0.0 due to improper input validation within the friendship link component . A remote attacker can exploit this by delivering a crafted script to execute arbitrary code, potentially leading to unauthorized actions on the affected s...

CVE-2024-33444

SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component...

CVE-2024-31621

An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component...

CVE-2024-33444

SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component...

CVE-2024-31621

An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component...

CVE-2024-31621: Improper Control of Generation of Code

An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component...

CVE-2024-31621

An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component...

CVE-2024-32358

An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033...

CVE-2024-32358

An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033...

CVE-2024-32358

The Jpress blogging platform, specifically v.5.1.0 , contains a security vulnerability that allows a remote attacker to achieve arbitrary code execution . The issue originates from a flaw in the custom plug-in module functionality, where a crafted script can be sent to the module to execute unaut...

CVE-2024-31574: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in TWCMS v.2.6 allows a local attacker to execute arbitrary code via a crafted script...

CVE-2024-32358

An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033...

CVE-2024-31666

An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the editaddonpost.php component...

CVE-2024-31666

A remote code execution (RCE) vulnerability exists in flusity-CMS v.2.33 within the edit_addon_post.php component. An attacker can exploit this by sending a crafted script to the component, which may lead to the execution of arbitrary code on the target server and potentially result in full contr...