CVE-2022-30500

Jfinal CMS 5.1.0 is vulnerable to SQL Injection. The root cause is a vulnerability in the getOrderby function where path components under /admin/ are directly spliced into SQL, enabling attackers to inject SQL. Available descriptions confirm the issue but do not provide a remediation or exploitat...

CVE-2022-30500

Jfinal cms 5.1.0 is vulnerable to SQL Injection...

Jfinal CMS SQL Injection Vulnerability

Jfinal CMS is a powerful information consulting website developed by java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.1 has a SQL injection vulnerability, the vulnerability originate...

CVE-2022-30500: Improper Neutralization of Special Elements used in an SQL Command

Jfinal cms 5.1.0 is vulnerable to SQL Injection...

PT-2022-20144

Name of the Vulnerable Software and Affected Versions Jfinal cms version 5.1.0 Description The issue is related to SQL Injection. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

JFinal file validation vulnerability

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

cn.vonce:vonce-sqlbean (0.9.6), com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1) +12 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (>=4.0, <=4.4)

com.jfinal:jfinal MAVEN version =4.0, =1.0, =1.2.0, =2.0.4, =3.14.1.release, =1.8, =3.0.3, =2.1.1, =3.3.3.v20190620-release, =3.5.1.v20190826-release Source cves: CVE-2019-17352 Source advisory: OSV:GHSA-279P-PC38-XX4P...

cn.eova:eova (>=1.6-beta4, <=1.6-beta5), cn.zcltd.btg:btg-autoroute-jfinal (3.0.3) +11 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.3)

com.jfinal:jfinal MAVEN version 3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta4, =1.0, =2.0.4, =1.0.0, =0.0.1, =2.0.2.v20171129-release, =2.2.0.v20180405-release Source cves:...

cc.ecore:spring-jfinal (0.0.1), cn.codeforfun:jfinal-activemq (0.3) +24 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (2.2)

com.jfinal:jfinal MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal 0.0.1 - cn.codeforfun:jfinal-activemq 0.3 - cn.codeforfun:jfinal-quartz 0.1 - cn.eova:eova =1.5.0, =2.2,...

cn.vonce:vonce-sqlbean (0.9.6), com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1) +12 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (>=4.0, <=4.4)

com.jfinal:jfinal MAVEN version =4.0, =1.0, =1.2.0, =2.0.4, =3.14.1.release, =1.8, =3.0.3, =2.1.1, =3.3.3.v20190620-release, =3.5.1.v20190826-release Source cves: CVE-2019-17352 Source advisory: GHSA-279P-PC38-XX4P...

cn.51daxia:zzz-websocket (>=1.0, <=1.1), com.github.grtechtv:enjoy-mapper (1.0.0) +17 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.8)

com.jfinal:jfinal MAVEN version 3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.51daxia:zzz-websocket =1.0, =1.1 - com.github.grtechtv:enjoy-mapper 1.0.0 -...

cn.dreampie:jfinal-akka (0.1), cn.dreampie:jfinal-captcha (0.1) +16 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (1.8)

com.jfinal:jfinal MAVEN version 1.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.dreampie:jfinal-akka 0.1 - cn.dreampie:jfinal-captcha 0.1 - cn.dreampie:jfinal-coffeescript 0.1 - cn.dreampie:jfinal-dreampi...

com.github.sogyf:jfinal-app (0.0.9), org.beetl:beetl-core (>=2.0.2, <=2.2.3) potentially affected by CVE-2019-17352 via com.jfinal:jfinal (1.6)

com.jfinal:jfinal MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.sogyf:jfinal-app 0.0.9 - org.beetl:beetl-core =2.0.2, =2.2.3 Source cves: CVE-2019-17352 Source advisory:...

GHSA-279P-PC38-XX4P JFinal file validation vulnerability

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

cn.com.itez:jwinner-base (>=0.0.8, <=0.1.2), cn.com.itez:jwinner-core (>=0.0.8, <=0.1.2) +13 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.5)

com.jfinal:jfinal MAVEN version 3.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.com.itez:jwinner-base =0.0.8, =0.0.8, =0.0.8, =4.0.1, =1.0, =2018.9, =1.0, =1.7.0, =3.2.1.v20181024-release,...

cn.zcltd.btg:btg-httpsession (>=4.0.2, <=4.0.11), com.github.gaols:jfinal-springtx-plugin (2.0.2) +6 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.6)

com.jfinal:jfinal MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.zcltd.btg:btg-httpsession =4.0.2, =2.2, =2.0-rc.6, =1.3.3, =1.3.5 Source cves: CVE-2019-17352 Source advisory:...

cn.eova:eova (>=1.6-beta2, <=1.6-beta3), cn.liangyuen:jfinal-slf4j (1.0) +7 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.2)

com.jfinal:jfinal MAVEN version 3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta2, =1.0, =1.3, =2.0.0, =1.0.0.v20180413-release, =1.0.0.v20180413-release, =2.0.0.v20170824-release,...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +2 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (1.4)

com.jfinal:jfinal MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =1.0.10, =1.0.11 - com.jfinal:jfinal-ext 3.0.1 Source cves: CVE-2019-17352 Source...

com.jayqqaa12:jbase (>=2.9.6, <=3.0.3), com.jfinal:jfinal-ext2 (>=2.0.3, <=2.0.4) +4 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (2.1)

com.jfinal:jfinal MAVEN version 2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jayqqaa12:jbase =2.9.6, =2.0.3, =1.6, =1.7 - com.jflyfox:jflyfoxjfinal 4.0 - net.dreamlu:jfinal-assets 0.0.3 -...

com.github.sunlin901203:sunny (>=0.0.1, <=0.0.4), com.ibeetl:beetl (>=2.2.5, <=2.7.5) +8 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (2.0)

com.jfinal:jfinal MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.sunlin901203:sunny =0.0.1, =2.2.5, =1.0.0, =2.5, =1.3, =0.0.1, =0.0.1, =0.0.3 - net.xwzhou.commons:commons 0.0.2 -...