PT-2023-31555 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: The issue allows a remote attacker to read files via ../ Directory Traversal in the "/common/down/file" fileKey parameter. This could potentially lead to unauthorized access to sensitive information...

GHSA-HJFP-2J7Q-XMX4 Cross-site Scripting in JFinalCMS

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting XSS vulnerability in the model management department...

GHSA-F2W8-4M48-5QRQ Cross-site Scripting in JFinalCMS

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting XSS vulnerability in the column management department...

CVE-2023-49487

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting XSS vulnerability in the navigation management department...

JFinalCMS 安全漏洞

JFinalCMS is a content management system. JFinalCMS v5.0.0 version exists cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the section management department, an attacker can exploit this vulnerability by injecti...

CVE-2023-49493

DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting XSS vulnerability via the v parameter at selectimages.php...

CVE-2023-48825

Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code...

Availability Booking Calendar Security Breach

PHPJabbers Availability Booking Calendar is a booking system. A security vulnerability exists in Availability Booking Calendar version 5.0 that stems from the presence of multiple HTML injection vulnerabilities...

Desdev DedeCMS Security Breach

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has the functions of content publishing, content management, content editing and content retrieval. A security vulnerability exists ...

Availability Booking Calendar Security Breach

PHPJabbers Availability Booking Calendar is a booking system. A security vulnerability exists in Availability Booking Calendar version 5.0, which stems from a lack of rate limiting in pjActionAJaxSend, which allows an attacker to exhaust system resources...

PT-2023-30969 · Unknown · Availability Booking Calendar

Name of the Vulnerable Software and Affected Versions: Availability Booking Calendar version 5.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or the Default Country Code. Recommendations: For Availability Booking Calendar...

GHSA-CJ7J-23WF-MHRX Cross-Site Request Forgery in JFinalCMS

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/slide/delete...

GHSA-R7W2-J96V-VW8M Cross-Site Request Forgery in JFinalCMS via /admin/slide/update

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/slide/update...

GHSA-GW26-CCHC-8F2F Cross-Site Request Forgery in JFinalCMS via /admin/form/save

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/form/save...

CVE-2023-49447

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/nav/update...

CVE-2023-49382

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/div/delete...

CVE-2023-49373

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/slide/delete...

JFinalCMS Security Vulnerability

JFinalCMS is a content management system by heyewei individual developer. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/nav/delete component...

JFinalCMS Security Vulnerability

JFinalCMS is a content management system developed by heyewei. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/category/delete component...

PT-2023-31230 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the "/admin/nav/save" API endpoint. Recommendations: For JFinalCMS version 5.0.0, as a temporary...