2104 matches found
CVE-2026-11473 jflyfox jfinal_cms AdvicefeedbackController.java list sql injection
A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...
CVE-2026-11473 jflyfox jfinal_cms AdvicefeedbackController.java list sql injection
A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...
CVE-2026-11473 jflyfox jfinal_cms AdvicefeedbackController.java list sql injection
A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...
jflyfox jfinal_cms injection vulnerability
jfinalcms is a content management system used for managing website sections, articles, and feedback content. jflyfox jfinalcms has a SQL injection vulnerability. The vulnerability arises due to the list function in the AdvicefeedbackController.java file not properly filtering the orderBy paramete...
PT-2026-47205
A vulnerability was identified in jflyfox jfinal cms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through ...
cn.niuable:tools-often (1.0.3), com.jfinal:jfinal-undertow (3.6) +9 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (2.2.33.final)
io.undertow:undertow-core MAVEN version 2.2.33.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.niuable:tools-often 1.0.3 - com.jfinal:jfinal-undertow 3.6 - io.jboot:jboot =4.1.7, =3.5.9, =3.5.9,...
com.jfinal:jfinal-undertow (2.6), io.undertow:karaf (2.0.39.final) +3 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (2.0.39.final)
io.undertow:undertow-core MAVEN version 2.0.39.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.jfinal:jfinal-undertow 2.6 - io.undertow:karaf 2.0.39.final - io.undertow:undertow-dist 2.0.39.fin...
CVE-2026-2200 heyewei JFinalCMS API Endpoint save cross site scripting
A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the publi...
CVE-2021-33348
An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases...
CVE-2021-31649
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute...
CVE-2022-38282
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list...
CVE-2022-38273
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/listapprove...
CVE-2022-38277
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list...
CVE-2022-38286
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list...
CVE-2022-38274
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list...
CVE-2022-38283
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list...
CVE-2022-38278
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list...
CVE-2022-38272
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list...