39 matches found
CVE-2021-42242
A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...
CVE-2022-28505
Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...
Sql injection
Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...
CVE-2022-28505
Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...
CVE-2022-28505
CVE-2022-28505 affects Jfinal_cms 5.1.0. The vulnerability is a SQL Injection in the server-side code, specifically in com.jflyfox.system.log.LogController.java, caused by missing validation of external input SQL statements. Public documents indicate that exploitation could lead to unauthorized S...
CVE-2022-28505
Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...
CVE-2022-27111
JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...
Design/Logic Flaw
JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...
CVE-2022-27111
CVE-2022-27111 affects Jfinal_CMS 5.1.0. The vulnerability is a cross-site scripting (XSS) flaw where the feedback feature can be abused to send malicious code to the administrator backend and have it executed. Root cause suggested by CNVD/CVE sources points to improper handling of user-supplied ...
CVE-2022-27111
JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...
CVE-2022-27111
JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...
CVE-2021-46087
In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...
Design/Logic Flaw
In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...
CVE-2021-46087
CVE-2021-46087 corresponds to a stored XSS vulnerability in the JFinal CMS (jfinal_cms) with version qualification “>= 5.1.0” as described in the CVE summary. The vulnerability arises because the application does not filter user input from forms submitted in the background/administrative inter...
CVE-2021-37262
JFinalcms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service...
CVE-2021-37262
JFinalcms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service...
Design/Logic Flaw
JFinalcms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service...
CVE-2021-37262
CVE-2021-37262 affects JFinal_cms 5.1.0. The vulnerability is a regex injection in handling user input, leading to Denial of Service. Multiple connected sources confirm the app/framework context and the nature of the issue, but no concrete exploit details or official fix/version remediation are p...