CVE-2024-53477

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...

CVE-2024-53477

JFinal CMS version 5.1.0 is vulnerable to Command Execution due to the unauthorized execution of deserialization within the ApiForm.java file (CWE-502). An attacker can exploit this flaw to execute arbitrary commands on the system. As a temporary workaround, it is recommended to disable deseriali...

com.github.miemiedev:mybatis-paginator (>=1.2.10, <=1.2.17), com.hastybox:lesscss-compile-service (>=0.2.0, <=0.2.1) +43 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (3.0.0.release)

org.springframework:spring-web MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.github.miemiedev:mybatis-paginator =1.2.10, =0.2.0, =1.2.0, =1.0rc2, =5.2.0, =5.3.1 and...

PT-2024-39248 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS versions up to 1.0 Description: A critical issue affects the delete function of the file /admin/template/edit. The manipulation of the name argument leads to path traversal, allowing an attacker to delete arbitrary files. This issue...

CVE-2024-8706

A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +175 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (3.2.0.release)

org.springframework:spring-expression MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =0.4.0, =0.0.1, =0.0.1, =0.0.1,...

Cross-Site Scripting (XSS)

com.jfinal, jfinal is vulnerable to Cross-site scripting. The vulnerability is due to improper input validation in the Title parameter in the /admin/content file, which can be manipulated to inject malicious scripts. Attackers can exploit this vulnerability remotely to execute arbitrary scripts i...

SQL Injection

com.jfinal, jfinal is vulnerable to SQL injection. The vulnerability is due to improper input validation in the DivDataControllerdata method, allowing attackers to execute arbitrary SQL commands by manipulating the tableName field of a custom div object. Attackers can exploit this flaw by creatin...

Cross Site Scripting (XSS)

com.jfinal: jfinal is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper handling of the password parameter within the /admin/login route . This allows attackers to execute arbitrary code via crafted malicious URLs, resulting in Cross-Site Scripting...

com.lambkit:lambkit (>=1.0.2, <=1.0.3), io.jboot:jboot (>=2.2.5, <=2.3.0) +1 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.7)

com.jfinal:jfinal MAVEN version 4.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.lambkit:lambkit =1.0.2, =2.2.5, =3.5.6.v20191101-release, =3.5.7.v20191115-release Source cves: CVE-2024-22497 Source...

com.jfinal:jfinal-undertow (3.0), com.lastb7:jfinal-swagger-knife4j (>=2.10.1, <=3.0.0) +2 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (5.0.0)

com.jfinal:jfinal MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 3.0 - com.lastb7:jfinal-swagger-knife4j =2.10.1, =1.0.4, =3.15.1, =3.15.5 Source cves:...

cn.eova:eova (>=1.6-beta4, <=1.6-beta5), cn.zcltd.btg:btg-autoroute-jfinal (3.0.3) +11 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (3.3)

com.jfinal:jfinal MAVEN version 3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta4, =1.0, =2.0.4, =1.0.0, =0.0.1, =2.0.2.v20171129-release, =2.2.0.v20180405-release Source cves:...

com.github.fangjinuo.sqlhelper:sqlhelper-jfinal (>=3.6.11, <=3.6.16), io.github.bes2008.solution.sqlhelper:sqlhelper-jfinal (>=4.0.0, <=6.0.0) +1 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.9.20)

com.jfinal:jfinal MAVEN version 4.9.20 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.fangjinuo.sqlhelper:sqlhelper-jfinal =3.6.11, =4.0.0, =6.0.1, =6.0.6 Source cves: CVE-2024-22497 Source advisory:...

cn.benma666:sql-jfinal (>=3.30.7-release, <=3.30.11-release), com.ibeetl:sql-jfinal (>=3.1.1-release, <=3.40.2-release) +2 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.9.03)

com.jfinal:jfinal MAVEN version 4.9.03 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.benma666:sql-jfinal =3.30.7-release, =3.1.1-release, =3.6.0, =3.6.8 Source cves: CVE-2024-22497 Source advisory:...

io.jboot:jboot (>=3.13.5, <=3.14.0) potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.9.18)

com.jfinal:jfinal MAVEN version 4.9.18 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - io.jboot:jboot =3.13.5, =3.14.0 Source cves: CVE-2024-22497 Source advisory: OSV:GHSA-QH2W-9M7W-HJG2...

com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1), com.jfinal:jfinal-undertow (1.9) potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.4)

com.jfinal:jfinal MAVEN version 4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.artislong:jfinal-spring-boot-starter =1.0, =2.1 - com.jfinal:jfinal-undertow 1.9 Source cves: CVE-2024-22497 Source...

dev.bomu:motan (0.1), io.jboot:jboot (>=2.2.0, <=2.2.2) +1 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.5)

com.jfinal:jfinal MAVEN version 4.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - dev.bomu:motan 0.1 - io.jboot:jboot =2.2.0, =3.5.2.v20190910-release, =3.5.5.v20191010-release Source cves: CVE-2024-22497 Sour...

cn.dev33:sa-token-jboot-plugin (>=1.29.1.trial, <=1.46.0), cn.dev33:sa-token-jfinal-plugin (>=1.29.1.trial, <=1.46.0) +8 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.9.17)

com.jfinal:jfinal MAVEN version 4.9.17 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.dev33:sa-token-jboot-plugin =1.29.1.trial, =1.29.1.trial, =2.0.1, =2.1.0, =1.0.8, =3.13.0, =3.8.3.v20220902-release,...

io.jboot:jboot (>=3.9.11, <=3.9.12) potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.9.10)

com.jfinal:jfinal MAVEN version 4.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - io.jboot:jboot =3.9.11, =3.9.12 Source cves: CVE-2024-22497 Source advisory: OSV:GHSA-QH2W-9M7W-HJG2...

com.jfinal:jfinal-weixin (2.9), com.jiubanqingchen:wish (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (4.9.05)

com.jfinal:jfinal MAVEN version 4.9.05 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-weixin 2.9 - com.jiubanqingchen:wish =0.0.1, =3.6.9, =2.0.4, =2.0.5 Source cves: CVE-2024-22497 Source...