Jfinal CMS path traversal vulnerability

Jfinal CMS is a powerful information consulting website developed in java that uses JFinal as the web framework, beetl for the template engine, mysql for the database, and bootstrap framework for the front end. an improper access control vulnerability exists in Jfinal CMS 4.7.1 and earlier...

Jfinal CMS path traversal vulnerability

Jfinal CMS is a powerful information consulting website developed in java, using JFinal as the web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS 4.7.1 and earlier versions have improper access control vulnerabilities. An attacker could use t...

Jfinal CMS path traversal vulnerability

Jfinal CMS is a powerful information consulting website developed in java, using the JFinal web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS 4.7.1 and earlier versions exist improper access control vulnerabilities. An attacker can use the...

Jfinal CMS command injection vulnerability

Jfinal CMS is a powerful information consulting website developed in java, using JFinal as the web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS 4.7.1 and earlier versions exist command injection vulnerability. An attacker can upload a...

CVE-2021-40639: Exposure of Resource to Wrong Sphere

Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js...

CVE-2020-19151: Improper Neutralization of Special Elements used in a Command

Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinalcms/admin/filemanager/list'...

cc.jweb:jweb-adai (>=1.0.2, <=1.0.6), cc.jweb:jweb-boot (>=1.0.0, <=1.0.5) +34 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (>=4.0, <=4.9.10)

com.jfinal:jfinal MAVEN version =4.0, =1.0.2, =1.0.0, =3.30.7-release, =1.0, =1.2.0, =2.0.4, =3.14.1.release, =3.0.2-release, =1.8, =2.5 and more Source cves: CVE-2021-33348 Source advisory: OSV:GHSA-2C25-XFPQ-8W9R...

com.github.jieblog:jfinal-shiro (>=1.0, <=3.1.0), com.github.piaohao:act-jfinal (1.0) +9 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (3.1)

com.jfinal:jfinal MAVEN version 3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.jieblog:jfinal-shiro =1.0, =1.0-alpha2, =1.5.3, =1.0.0, =1.8.0, =1.8.2 Source cves: CVE-2021-33348 Source advisory:...

cn.eova:eova (>=1.6-beta2, <=1.6-beta3), cn.liangyuen:jfinal-slf4j (1.0) +7 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (3.2)

com.jfinal:jfinal MAVEN version 3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta2, =1.0, =1.3, =2.0.0, =1.0.0.v20180413-release, =1.0.0.v20180413-release, =2.0.0.v20170824-release,...

cc.ecore:spring-jfinal (0.0.1), cn.codeforfun:jfinal-activemq (0.3) +24 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (2.2)

com.jfinal:jfinal MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal 0.0.1 - cn.codeforfun:jfinal-activemq 0.3 - cn.codeforfun:jfinal-quartz 0.1 - cn.eova:eova =1.5.0, =2.2,...

cn.com.itez:jwinner-base (>=0.0.8, <=0.1.2), cn.com.itez:jwinner-core (>=0.0.8, <=0.1.2) +13 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (3.5)

com.jfinal:jfinal MAVEN version 3.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.com.itez:jwinner-base =0.0.8, =0.0.8, =0.0.8, =4.0.1, =1.0, =2018.9, =1.0, =1.7.0, =3.2.1.v20181024-release,...

cn.fsdev:jfinal-mail-plugin (3.0), cn.yerl.web:spring-boot-starter-sso-client (1.0.0) +10 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (3.0)

com.jfinal:jfinal MAVEN version 3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.fsdev:jfinal-mail-plugin 3.0 - cn.yerl.web:spring-boot-starter-sso-client 1.0.0 - com.ejlchina:bean-searcher =1.1.1, =0.2,...

cn.zcltd.btg:btg-httpsession (>=4.0.2, <=4.0.11), com.github.gaols:jfinal-springtx-plugin (2.0.2) +6 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (3.6)

com.jfinal:jfinal MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.zcltd.btg:btg-httpsession =4.0.2, =2.2, =2.0-rc.6, =1.3.3, =1.3.5 Source cves: CVE-2021-33348 Source advisory:...

com.jfinal:jfinal-undertow (1.6), io.jboot:jboot (>=2.0, <=2.0.4) potentially affected by CVE-2021-33348 via com.jfinal:jfinal (3.7)

com.jfinal:jfinal MAVEN version 3.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 1.6 - io.jboot:jboot =2.0, =2.0.4 Source cves: CVE-2021-33348 Source advisory: OSV:GHSA-2C25-XFPQ-8W...

Cross-site scripting in jfinal

An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases...

cn.eova:eova (>=1.6-beta4, <=1.6-beta5), cn.zcltd.btg:btg-autoroute-jfinal (3.0.3) +11 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (3.3)

com.jfinal:jfinal MAVEN version 3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta4, =1.0, =2.0.4, =1.0.0, =0.0.1, =2.0.2.v20171129-release, =2.2.0.v20180405-release Source cves:...

com.github.sogyf:jfinal-app (0.0.9), org.beetl:beetl-core (>=2.0.2, <=2.2.3) potentially affected by CVE-2021-33348 via com.jfinal:jfinal (1.6)

com.jfinal:jfinal MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.sogyf:jfinal-app 0.0.9 - org.beetl:beetl-core =2.0.2, =2.2.3 Source cves: CVE-2021-33348 Source advisory:...

com.github.subchen:jetbrick-template (>=1.0.0, <=1.2.6), com.github.zqq90.webit-script:webit-script (>=1.2.2, <=1.4.0) +3 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (1.5)

com.jfinal:jfinal MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.subchen:jetbrick-template =1.0.0, =1.2.2, =1.4.1, =2.0.0-beta, =2.7.0-beta Source cves: CVE-2021-33348 Source...

cn.dreampie:jfinal-dreampie (>=1.0, <=1.2.2), cn.dreampie:jfinal-lesscss (0.1) +8 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (1.9)

com.jfinal:jfinal MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.dreampie:jfinal-dreampie =1.0, =0.1, =0.1, =2.4.0, =3.1.3, =0.1, =0.0.1, =0.0.3 Source cves: CVE-2021-33348 Source advisory:...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +2 more potentially affected by CVE-2021-33348 via com.jfinal:jfinal (1.4)

com.jfinal:jfinal MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =1.0.10, =1.0.11 - com.jfinal:jfinal-ext 3.0.1 Source cves: CVE-2021-33348 Source...