CVE-2021-42242

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

CVE-2021-42242

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

Command injection

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

CVE-2021-42242

CVE-2021-42242 affects jfinal_cms 5.0.1; a command injection vulnerability exists via com.jflyfox.component.controller.Ueditor due to inadequate filtering of command-related characters, enabling arbitrary command execution. Descriptions across NVD, CNVD/CNNVD and OSV corroborate a remote command ...

CVE-2021-42242

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

CVE-2021-42242: Undefined Security Weakness

A command execution vulnerability exists in jfinalcms 5.0.1 via com.jflyfox.component.controller.Ueditor...

CVE-2022-28505

Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...

Sql injection

Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...

CVE-2022-28505

Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...

CVE-2022-28505

CVE-2022-28505 affects Jfinal_cms 5.1.0. The vulnerability is a SQL Injection in the server-side code, specifically in com.jflyfox.system.log.LogController.java, caused by missing validation of external input SQL statements. Public documents indicate that exploitation could lead to unauthorized S...

CVE-2022-28505

Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...

CVE-2022-28505: Improper Neutralization of Special Elements used in an SQL Command

Jfinalcms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java...

CVE-2022-27111

JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...

Design/Logic Flaw

JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...

CVE-2022-27111

CVE-2022-27111 affects Jfinal_CMS 5.1.0. The vulnerability is a cross-site scripting (XSS) flaw where the feedback feature can be abused to send malicious code to the administrator backend and have it executed. Root cause suggested by CNVD/CVE sources points to improper handling of user-supplied ...

CVE-2022-27111

JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...

CVE-2022-27111

JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...

CVE-2022-27111: Improper Neutralization of Input During Web Page Generation

JfinalCMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it...

CVE-2021-46087

In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...

Design/Logic Flaw

In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...