450 matches found
CVE-2020-19151
Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinalcms/admin/filemanager/list'...
CVE-2020-19155
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename' function in the component 'modules/filemanager/FileManagerController.java'...
CVE-2025-3214
A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of the file /readTemplate. The manipulation of the argument template leads to path traversal. The attack can be launched remotely. The exploit...
CVE-2025-3214
A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of the file /readTemplate. The manipulation of the argument template leads to path traversal. The attack can be launched remotely. The exploit...
CVE-2025-3214 JFinal CMS readTemplate engine.getTemplate path traversal
A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of the file /readTemplate. The manipulation of the argument template leads to path traversal. The attack can be launched remotely. The exploit...
CVE-2025-3214 JFinal CMS readTemplate engine.getTemplate path traversal
A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of the file /readTemplate. The manipulation of the argument template leads to path traversal. The attack can be launched remotely. The exploit...
CVE-2025-3214
CVE-2025-3214 affects JFinal CMS up to version 5.2.4. The vulnerability resides in the readTemplate function’s engine.getTemplate, where manipulating the template argument enables path traversal. Exploitation can be remote, and public proofs exist, but the real existence of the vulnerability is d...
The vulnerability of the TemplateHandler component in the \src\main\java\com\cms\controller\admin\TemplateController.java file of the Jfinal CMS content management system allows a hacker to execute arbitrary code.
The vulnerability of the TemplateHandler component in the \src\main\java\com\cms\controller\admin\TemplateController.java file of the Jfinal CMS content management system is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...
PT-2024-17558 · Jfinalcms · Jfinalcms
Name of the Vulnerable Software and Affected Versions: JFinalCMS version 1.0 Description: The issue is related to a cross-site request forgery CSRF vulnerability in the /admin/tag/save file of the JFinalCMS system. This vulnerability can be exploited remotely, allowing an attacker to perform a CS...
CVE-2024-53477
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...
CVE-2024-53477
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...
CVE-2024-53477
CVE-2024-53477 affects JFinal CMS 5.1.0. The vulnerability is due to unauthorized deserialization in ApiForm.java, enabling remote command execution (described as a total impact on confidentiality, integrity, and availability with network attack vector and no user interaction). The CVSS v3.1 vect...
CVE-2024-53477
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...
CVE-2024-53477
JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...
jfinal cms 安全漏洞
jfinal cms is a java development of powerful information consulting website, using the simple and powerful JFinal as the web framework, template engine with beetl, database with mysql, front-end bootstrap framework. A security vulnerability exists in jfinal cms version 5.1.0. An attacker can...
PT-2024-35755 · Jfinalcms · Jfinalcms
Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue concerns the unauthorized execution of deserialization in the ApiForm.java file, leading to command execution. Recommendations: For JFinal CMS version 5.1.0, consider disabling the deserializati...
PT-2024-39248 · Jfinalcms · Jfinalcms
Name of the Vulnerable Software and Affected Versions: JFinalCMS versions up to 1.0 Description: A critical issue affects the delete function of the file /admin/template/edit. The manipulation of the name argument leads to path traversal, allowing an attacker to delete arbitrary files. This issue...
CVE-2024-8706
A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to...
PT-2023-31473 · Jfinalcms · Jfinalcms
Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: The issue is related to Cross Site Scripting XSS via Label management editing. This means an attacker could potentially inject malicious scripts into the website, affecting users who access the edited...