Sql injection

Jfinal cms 5.1.0 is vulnerable to SQL Injection...

CVE-2022-30500

Jfinal cms 5.1.0 is vulnerable to SQL Injection...

CVE-2022-30500

Jfinal CMS 5.1.0 is vulnerable to SQL Injection. The root cause is a vulnerability in the getOrderby function where path components under /admin/ are directly spliced into SQL, enabling attackers to inject SQL. Available descriptions confirm the issue but do not provide a remediation or exploitat...

CVE-2022-30500

Jfinal cms 5.1.0 is vulnerable to SQL Injection...

Jfinal CMS SQL注入漏洞

Jfinal CMS is a powerful information consulting website developed by java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.1 has a SQL injection vulnerability, the vulnerability originate...

cc.ecore:spring-jfinal (=0.0.1), cc.ecore:spring-jfinal-plugin (>=0.1.0 <=0.1.2) +134 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (>=1.4 <=4.4)

com.jfinal:jfinal MAVEN version =1.4, =0.1.0, =0.1.1, =1.0, =0.0.8, =0.0.8, =0.0.8, =0.1, =1.2.2 - cn.dreampie:jfinal-flyway =0.1 - cn.dreampie:jfinal-lesscss =0.1 and more Source cves: CVE-2019-17352 Source advisory: OSV:GHSA-279P-PC38-XX4P...

GHSA-279P-PC38-XX4P JFinal file validation vulnerability

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

JFinal file validation vulnerability

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

cc.ecore:spring-jfinal (=0.0.1), cc.ecore:spring-jfinal-plugin (>=0.1.0 <=0.1.2) +162 more potentially affected by CVE-2021-31649 via com.jfinal:jfinal (>=1.4 <=4.9.08)

com.jfinal:jfinal MAVEN version =1.4, =0.1.0, =0.1.1, =1.0.0, =1.0, =3.30.7-RELEASE, =0.0.8, =0.0.8, =0.0.8, =1.29.1.trial, =1.29.1.trial, =1.45.0 - cn.dreampie:jfinal-akka =0.1 - cn.dreampie:jfinal-captcha =0.1 and more Source cves: CVE-2021-31649 Source advisory: OSV:GHSA-H3J8-FR5Q-8RFR...

JFinal Java Deserialization Vulnerability

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis which can lead to remote code execution...

GHSA-H3J8-FR5Q-8RFR JFinal Java Deserialization Vulnerability

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis which can lead to remote code execution...

be.fluid-it.guice.extensions:guice-multi-shiro-realms (=0.1-1), be.fluid-it.shiro.jee:shiro-jee-authc (>=0.1-1 <=0.1-3) +1469 more potentially affected by CVE-2016-4437 via org.apache.shiro:shiro-core (>=1.0.0-incubating <=1.2.4)

org.apache.shiro:shiro-core MAVEN version =1.0.0-incubating, =0.1-1, =4.0.0-RC2, =1.0.0, =2.0.0, =0.0.2, =0.1, =0.1, =0.1, =2.1.0-RELEASE, =1.0, =1.0.3 - cn.org.awcp:awcp-formdesigner-application =1.0-RELEASE - cn.org.awcp:awcp-formdesigner-applicationImpl =1.0-RELEASE -...

Jfinal CMS Command Injection Vulnerability

Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.0.1 has a command injection vulnerability, which originates from...

Jfinal CMS SQL Injection Vulnerability

Jfinal CMS is a java development information consulting website. jfinal CMS version 5.1.0 is vulnerable to SQL injection, which originates from com.jflyfox.system.log.LogController.java missing validation of external input SQL statements. An attacker could use this vulnerability to execute illega...

CVE-2021-42242

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

Jfinal CMS 安全漏洞

Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.0.1 has a command injection vulnerability, which originates from...

CVE-2022-28505

Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...

Jfinal CMS SQL注入漏洞

Jfinal CMS is a java development information consulting website. jfinal CMS version 5.1.0 is vulnerable to SQL injection, which originates from com.jflyfox.system.log.LogController.java missing validation of external input SQL statements. An attacker could use this vulnerability to execute illega...

JFinal SQL注入漏洞

JFinal is a Java-based open source framework for WEB + ORM . JFinal CMS v2.0 version of the SQL injection vulnerability , the vulnerability stems from the lack of article management function for SQL data filtering and escaping...

Jfinal CMS Cross-Site Scripting Vulnerability (CNVD-2022-81357)

Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.1.0 has a cross-site scripting vulnerability, the vulnerability...