CVE-2023-24747

Jfinal CMS v5.1 was discovered to contain a cross-site scripting XSS vulnerability via the component /system/dict/list...

jfinal cms 跨站脚本漏洞

jfinal cms is a java development of powerful information consulting website , using the simple and powerful JFinal as the web framework , template engine with beetl , database with mysql , front-end bootstrap framework . A security vulnerability exists in jfinal cms version 5.1, which originates...

PT-2023-19764 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: Jfinal CMS version 5.1 Description: A cross-site scripting XSS issue was found in Jfinal CMS via the component "/system/dict/list". This component is an API endpoint that is susceptible to XSS attacks. Recommendations: For Jfinal CMS version...

CVE-2023-24747

Jfinal CMS v5.1 was discovered to contain a cross-site scripting XSS vulnerability via the component /system/dict/list...

CVE-2023-24747

CVE-2023-24747 affects Jfinal CMS v5.1, with a cross-site scripting (XSS) vulnerability exposed via the /system/dict/list endpoint. Public sources in the connected data confirm the issue is an XSS bug in that API component; no exploitation status is provided in the documents. The CVSSv3.1 base sc...

CVE-2023-22975

A cross-site scripting XSS vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html...

CVE-2023-22975

A cross-site scripting XSS vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html...

Cross site scripting

A cross-site scripting XSS vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html...

CVE-2023-22975

A cross-site scripting XSS vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html...

PT-2023-18808 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under "/front/person/profile.html". Recommendations: For...

JFinal 跨站脚本漏洞

JFinal is a Java language based WEB + ORM open source framework. JFinal version 5.1.0 suffers from a cross-site scripting vulnerability that stems from not filtering user input , resulting in cross-site scripting...

CVE-2023-22975

A cross-site scripting XSS vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html...

CVE-2022-37202

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list...

Sql injection

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list...

CVE-2022-37202

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list...

JFinal SQL注入漏洞

JFinal is a Java language based WEB + ORM open source framework. JFinal CMS version 5.1.0 has a security vulnerability , the vulnerability stems from vulnerability to SQL injection attacks via /admin/advicefeedback/list...

CVE-2022-37202

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list...

CVE-2022-37202

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list...

CVE-2022-37202

CVE-2022-37202 affects JFinal CMS 5.1.0, where multiple interfaces (e.g., /admin/advicefeedback/list) expose SQL Injection due to unsafe SQL concatenation in distinct components. The CVSS 3.1 vector indicates NETWORK attack vector, LOW attack complexity, LOW privileges required, and high impact t...

CVE-2022-37208

JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection...