CVE-2022-37204

CVE-2022-37204 CVE-2022-37204 POC Suggested description RESERVED JFinal CMS 5.1.0 is vulnerable to SQL Injection. Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql7.md Vulnerability Type SQL Injection Vendor of Product the development group...

CVE-2022-37205

CVE-2022-37205 CVE-2022-37205 POC Suggested description RESERVED JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2022-37209

CVE-2022-37209 CVE-2022-37209 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2022-37210

CVE-2022-37210 CVE-2022-37210 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2022-37208

37208 CVE-2022-37208 Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2022-37206

CVE-2022-37206 CVE-2022-37206 POC Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql2.md Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0...

CVE-2022-37203

CVE-2022-37203 CVE-2022-37203 POC Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql3.md Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0...

CVE-2022-37202

CVE-2022-37202 CVE-2022-37202 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0 Affected Component These interfaces...

CVE-2022-37207

CVE-2022-37207 CVE-2022-37207 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection Additional Information...

CVE-2022-37201

CVE-2022-37201 CVE-2022-37201 POC POC First of all you should install sqlmap you need set target domain or IP your cookie the run the shell sqlmap -u http://targetDomainOrIP/jfinalcms/jfinalcms/admin/contact/list --thread 8 --batch --smart --random-agent --data "...

at.molindo.social:spring-social-security (1.1.4.release), cc.ecore:spring-jfinal (0.0.1) +145 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (3.2.13.release)

org.springframework:spring-expression MAVEN version 3.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-security 1.1.4.release -...

at.molindo.social:spring-social-security (1.1.4.release), cc.ecore:spring-jfinal (0.0.1) +166 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.2.13.release)

org.springframework:spring-core MAVEN version 3.2.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - at.molindo.social:spring-social-security 1.1.4.release - cc.ecore:spring-jfinal 0.0.1 -...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.1), com.bnd-lib:bnd-chemistry (0.7.0) +59 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (3.2.0.release)

org.springframework:spring-webmvc MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1 - com.bnd-lib:bnd-chemistry 0.7.0 -...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.1), com.bnd-lib:bnd-chemistry (0.7.0) +59 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.0.release)

org.springframework:spring-webmvc MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1 - com.bnd-lib:bnd-chemistry 0.7.0 -...

CVE-2026-11473

A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...

jflyfox jfinal_cms SQL injection vulnerability

jfinalcms is a content management system used for managing website sections, articles, and feedback content. jflyfox jfinalcms has a SQL injection vulnerability. The vulnerability arises due to the list function in the AdvicefeedbackController.java file not properly filtering the orderBy paramete...

CVE-2026-11473

A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...

EUVD-2026-35004

A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...

CVE-2026-11473

The CVE concerns jflyfox jfinal_cms (versions up to 5.1.0). The vulnerability is in AdvicefeedbackController.java list functionality, where improper handling of the orderBy argument enables SQL injection. This can be exploited remotely. The issue was reported early via an issue and no public resp...

CVE-2026-11473

A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...