CVE-2023-50100: Improper Neutralization of Input During Web Page Generation

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting XSS via carousel image editing...

CVE-2023-50137: Improper Neutralization of Input During Web Page Generation

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting XSS in the site management office...

PT-2023-31481 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: The issue is related to Cross Site Scripting XSS in the site management office. This means an attacker could potentially inject malicious scripts into the website, affecting users who visit the site...

CVE-2023-50137

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting XSS in the site management office...

JFinalCMS Cross-Site Scripting Vulnerability

JFinalCMS is a content management system by heyewei individual developer. A cross-site scripting vulnerability exists in JFinalCMS version 5.0.0, which stems from a cross-site scripting XSS vulnerability in Content data...

CVE-2023-50101

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting XSS via Label management editing...

CVE-2023-50137

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting XSS in the site management office...

CVE-2023-50100

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting XSS via carousel image editing...

CVE-2023-50102

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting XSS...

JFinalCMS Cross-Site Scripting Vulnerability (CNVD-2023-9773206)

JFinalCMS is a content management system. JFinalCMS suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of user-supplied data in the model management department, which can be exploited by an attacker to execute arbitrary Web script or HTML ...

JFinalCMS Cross-Site Scripting Vulnerability (CNVD-2023-9769208)

JFinalCMS is a content management system. JFinalCMS v5.0.0 version exists cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the navigation management department, an attacker exploits the vulnerability by injectin...

JFinalCMS Cross-Site Scripting Vulnerability (CNVD-2023-9815407)

JFinalCMS is a content management system. JFinalCMS v5.0.0 version exists cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the section management department, an attacker can exploit this vulnerability by injecti...

GHSA-7X2G-4JVC-4X6P Directory Traversal in JFinalCMS

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter...

Directory Traversal in JFinalCMS

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter...

CVE-2023-50449

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter...

CVE-2023-50449

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter...

Directory traversal

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter...

CVE-2023-50449: Improper Limitation of a Pathname to a Restricted Directory

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter...

PT-2023-31555 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: The issue allows a remote attacker to read files via ../ Directory Traversal in the "/common/down/file" fileKey parameter. This could potentially lead to unauthorized access to sensitive information...

CVE-2023-50449

Summary (CVE-2023-50449): JFinalCMS 5.0.0 is vulnerable to a remote directory traversal via the /common/down/file fileKey parameter, allowing reading of arbitrary files. Root cause: improper handling of the ../ path segment in the fileKey parameter. Documented by multiple sources (Red Hat, GHSA, ...