47 matches found
CVE-2026-11473: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in jflyfox jfinalcms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through a...
CVE-2022-27111
JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...
EUVD-2021-23834
Malware in sbrugna...
EUVD-2025-18363
Malicious code in bioql PyPI...
EUVD-2021-29220
Malicious code in bioql PyPI...
EUVD-2022-31650
Malicious code in bioql PyPI...
EUVD-2021-32789
Malicious code in bioql PyPI...
CVE-2025-6105
A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...
CVE-2025-6105
A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...
CVE-2025-6105 jflyfox jfinal_cms HOME.java cross-site request forgery
A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...
CVE-2025-6105
CVE-2025-6105 affects jflyfox jfinal_cms 5.0.1. The vulnerability is a cross-site request forgery in the HOME.java Logout argument, allowing remote abuse and potentially unauthorized operations. Exploitation is publicly disclosed; vendor response is noted as absent in the sources. Connected docum...
CVE-2025-6105 jflyfox jfinal_cms HOME.java cross-site request forgery
A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...
CVE-2025-6105: Cross-Site Request Forgery (CSRF)
A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...
CVE-2022-28505
Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...
CVE-2021-37262
JFinalcms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service...
CVE-2023-22975
CVE-2023-22975 is a cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 where a crafted payload placed in the email parameter of the /front/person/profile.html endpoint can cause arbitrary web scripts/HTML to run in a user’s browser. RedHat/CNNVD/OSV/NVD entries corroborate the issue; r...
CVE-2022-37223: Improper Neutralization of Special Elements used in an SQL Command
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinalcms/system/role/list...
CVE-2022-37199: Improper Neutralization of Special Elements used in an SQL Command
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinalcms/system/user/list...
CVE-2022-33114: Improper Neutralization of Special Elements used in an SQL Command
Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinalcms/system/dict/list...
