CVE-2026-11473: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...

CVE-2022-27111

JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...

EUVD-2021-23834

Malware in sbrugna...

EUVD-2022-31650

Malicious code in bioql PyPI...

EUVD-2021-29220

Malicious code in bioql PyPI...

EUVD-2025-18363

Malicious code in bioql PyPI...

EUVD-2021-32789

Malicious code in bioql PyPI...

CVE-2025-6105

A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2025-6105

A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2025-6105 jflyfox jfinal_cms HOME.java cross-site request forgery

A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2025-6105

CVE-2025-6105 affects jflyfox jfinal_cms 5.0.1. The vulnerability is a cross-site request forgery in the HOME.java Logout argument, allowing remote abuse and potentially unauthorized operations. Exploitation is publicly disclosed; vendor response is noted as absent in the sources. Connected docum...

CVE-2025-6105 jflyfox jfinal_cms HOME.java cross-site request forgery

A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2025-6105: Cross-Site Request Forgery (CSRF)

A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2022-28505

Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...

CVE-2021-37262

JFinalcms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service...

CVE-2023-22975

CVE-2023-22975 is a cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 where a crafted payload placed in the email parameter of the /front/person/profile.html endpoint can cause arbitrary web scripts/HTML to run in a user’s browser. RedHat/CNNVD/OSV/NVD entries corroborate the issue; r...

CVE-2021-42242

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

CVE-2021-42242

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

Command injection

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

CVE-2021-42242

CVE-2021-42242 affects jfinal_cms 5.0.1; a command injection vulnerability exists via com.jflyfox.component.controller.Ueditor due to inadequate filtering of command-related characters, enabling arbitrary command execution. Descriptions across NVD, CNVD/CNNVD and OSV corroborate a remote command ...