CVE-2026-11473

The CVE concerns jflyfox jfinal_cms (versions up to 5.1.0). The vulnerability is in AdvicefeedbackController.java list functionality, where improper handling of the orderBy argument enables SQL injection. This can be exploited remotely. The issue was reported early via an issue and no public resp...