cc.ecore:spring-jfinal (0.0.1), cn.codeforfun:jfinal-activemq (0.3) +24 more potentially affected by CVE-2021-31649 via com.jfinal:jfinal (2.2)

com.jfinal:jfinal MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal 0.0.1 - cn.codeforfun:jfinal-activemq 0.3 - cn.codeforfun:jfinal-quartz 0.1 - cn.eova:eova =1.5.0, =2.2,...

com.github.jieblog:jfinal-shiro (>=1.0, <=3.1.0), com.github.piaohao:act-jfinal (1.0) +9 more potentially affected by CVE-2021-31649 via com.jfinal:jfinal (3.1)

com.jfinal:jfinal MAVEN version 3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.jieblog:jfinal-shiro =1.0, =1.0-alpha2, =1.5.3, =1.0.0, =1.8.0, =1.8.2 Source cves: CVE-2021-31649 Source advisory:...

com.jfinal:jfinal-undertow (1.6), io.jboot:jboot (>=2.0, <=2.0.4) potentially affected by CVE-2021-31649 via com.jfinal:jfinal (3.7)

com.jfinal:jfinal MAVEN version 3.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 1.6 - io.jboot:jboot =2.0, =2.0.4 Source cves: CVE-2021-31649 Source advisory: OSV:GHSA-H3J8-FR5Q-8R...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +2 more potentially affected by CVE-2021-31649 via com.jfinal:jfinal (1.4)

com.jfinal:jfinal MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =1.0.10, =1.0.11 - com.jfinal:jfinal-ext 3.0.1 Source cves: CVE-2021-31649 Source...

Jfinal CMS Command Injection Vulnerability

Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.0.1 has a command injection vulnerability, which originates from...

Jfinal CMS SQL Injection Vulnerability

Jfinal CMS is a java development information consulting website. jfinal CMS version 5.1.0 is vulnerable to SQL injection, which originates from com.jflyfox.system.log.LogController.java missing validation of external input SQL statements. An attacker could use this vulnerability to execute illega...

CVE-2021-42242

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

PT-2022-11577

Name of the Vulnerable Software and Affected Versions jfinal cms version 5.0.1 Description A command execution issue exists via the com.jflyfox.component.controller.Ueditor component. Recommendations For jfinal cms version 5.0.1, consider restricting access to the...

Jfinal CMS security vulnerability

Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.0.1 has a command injection vulnerability, which originates from...

CVE-2022-28505

Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...

Jfinal CMS SQL Injection Vulnerability

Jfinal CMS is a java development information consulting website. jfinal CMS version 5.1.0 is vulnerable to SQL injection, which originates from com.jflyfox.system.log.LogController.java missing validation of external input SQL statements. An attacker could use this vulnerability to execute illega...

PT-2022-19057

Name of the Vulnerable Software and Affected Versions Jfinal cms version 5.1.0 Description The issue concerns SQL Injection via the com.jflyfox.system.log.LogController.java file. No information is provided about the estimated number of potentially affected devices worldwide or real-world inciden...

JFinal SQL Injection Vulnerability

JFinal is a Java-based open source framework for WEB + ORM . JFinal CMS v2.0 version of the SQL injection vulnerability , the vulnerability stems from the lack of article management function for SQL data filtering and escaping...

Jfinal CMS Cross-Site Scripting Vulnerability (CNVD-2022-81357)

Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.1.0 has a cross-site scripting vulnerability, the vulnerability...

CVE-2022-27111

JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...

PT-2022-18229

Name of the Vulnerable Software and Affected Versions Jfinal CMS version 5.1.0 Description The issue allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it. This can potentially lead to unauthorized access or control of the administrat...

Jfinal CMS Cross-Site Scripting Vulnerability

Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS version 5.1.0 has a cross-site scripting vulnerability, the vulnerability...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +175 more potentially affected by CVE-2022-22950 via org.springframework:spring-expression (3.2.0.release)

org.springframework:spring-expression MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =0.4.0, =0.0.1, =0.0.1, =0.0.1,...

GitHub Security Lab: [Java]: CWE-073 - File path injection with the JFinal framework

This bug was reported directly to GitHub Security Lab...

Jfinal CMS Cross-Site Scripting Vulnerability

Jfinal CMS is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. Jfinal CMS cross-site scripting vulnerability , the vulnerability stems from the...