532 matches found
CVE-2023-49396
CVE-2023-49396 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /admin/category/save endpoint. The issue originates from CSRF in how this endpoint handles requests, enabling potential unauthorized actions if a user is tricked into submitting a reques...
CVE-2023-49379
CVE-2023-49379 affects JFinalCMS v5.0.0. A CSRF in the /admin/friend_link/save component is described, with CVSS v3.1 base score 8.8 (HIGH) and user interaction required. The connected documents reiterate the same vulnerability; exploitation status and concrete remediation are not provided in the...
CVE-2023-49374
Concretely, CVE-2023-49374 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exploitable via /admin/slide/update. The NVD entry reports a CVSS v3.1 base score of 8.8 (High) with Network attack vector, no privileges required, user interaction required, and impacts to ...
CVE-2023-49378
CVE-2023-49378 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /admin/form/save endpoint. Root cause: CSRF in that API path. Impact is high across confidentiality, integrity, and availability (per NVD metrics: CVSS 3.1 base score 8.8, HIGH). Connect...
CVE-2023-49380
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/friendlink/delete...
CVE-2023-49396
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/save...
CVE-2023-49375
CVE-2023-49375 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability via the /admin/friend_link/update endpoint. The NVD entry reports CVSS v3.1 base score 8.8 (HIGH) with network attack vector, no user privileges, and required user interaction. Multiple connected adviso...
CVE-2023-47503
An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module...
CVE-2023-47503
An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module...
jfinalCMS Security Vulnerabilities
JFinalCMS is a content management system by heyewei personal developer. A security vulnerability exists in jfinalCMS version v.5.1.0, which originated from a vulnerability that allows remote attackers to execute arbitrary code via a crafted script...
CVE-2023-47503
An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module...
CVE-2023-47503
CVE-2023-47503 affects jflyfox jfinalCMS v5.1.0. Root cause: login.jsp in the template management module not properly restricted, enabling remote attackers to execute arbitrary code via a crafted script. Documented impact is arbitrary code execution with high severity (NVD CVSS 3.1 base score 9.8...
JFinalCMS Cross-Site Scripting Vulnerability
JFinalCMS is a content management system. JFinalCMS suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to embed malicious code on a web page...
PT-2023-28727 · Jfinalcms +1 · Jfinalcms +1
Name of the Vulnerable Software and Affected Versions: SpringbootCMS version 1.0 JFinalCMS affected versions not specified Description: The issue allows malicious code to be embedded in the foreground message and saved in the database. When users browse comments, the embedded malicious code in th...
JFinalCMS 跨站脚本漏洞
JFinalCMS is a content management system. JFinalCMS suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to embed malicious code on a web page...
PT-2023-28728 · Jfinalcms +1 · Jfinalcms +1
Name of the Vulnerable Software and Affected Versions: SpringbootCMS version 1.0 JFinalcms affected versions not specified Description: The issue exists in a newly created part of the background, where parameters submitted by users are not filtered. This allows special characters in parameters to...
JFinalCMS Directory Traversal Vulnerability
JFinalCMS is a java developed information consulting website. JFinalCMS suffers from a directory traversal vulnerability that can be exploited by an attacker to view arbitrary files on the system...
CVE-2023-41599
An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal...
