JFinal Cross-Site Scripting Vulnerability

JFinal is a Java language based WEB + ORM open source framework. A cross-site scripting vulnerability exists in JFinal version 5.0.0, which originates from allowing an attacker to run arbitrary code via the /admin/login username parameter...

Cross-site Scripting in JFinal

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML...

Cross Site Scripting (XSS)

com.jfinal:jfinal is vulnerable to Cross-site Scripting XSS. The vulnerability occurs due to insufficient user input sanitizations, which allows an authenticated attacker to inject and execute malicious javascript into the victim's browser...

Cross Site Scripting (XSS)

com.jfinal:jfinal is vulnerable to Cross-site Scripting XSS. Lack of proper validation for user input within the library's label management feature, exposes a Cross-Site Scripting XSS vulnerability which allows an authenticated attacker to inject malicious scripts into labels, which are then...

PT-2023-31473 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: The issue is related to Cross Site Scripting XSS via Label management editing. This means an attacker could potentially inject malicious scripts into the website, affecting users who access the edited...

Cross-site Scripting (XSS)

jfinal is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the modal management department of the library, allowing an attacker to inject and execute malicious JavaScript...

Cross-site Scripting (XSS)

jfinal is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the column management department of the library, allowing an attacker to inject and execute malicious JavaScript...

GHSA-9WVJ-WR2F-6MX6 Cross-Site Request Forgery in JFinalCMS

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/slide/save...

Arbitrary Code Execution

JFinal is vulnerable to Arbitrary Code Execution. The vulnerability exists because the login.jsp page is not properly restricted which allows an attacker to access and modify the content to inject and execute arbitrary code into the system...

PT-2023-30467 · Jflyfox · Jfinalcms

Name of the Vulnerable Software and Affected Versions: jflyfox jfinalCMS version 5.1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the "login.jsp" component in the template management module. Recommendations: For jflyfox jfinalCMS version 5.1....

jFinal Server-Side Template Injection vulnerability

Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...

CVE-2021-31635

Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...

CVE-2021-31635

Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...

CVE-2021-31635

Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...

Sql injection

Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...

CVE-2021-31635: Improper Control of Generation of Code

Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...

PT-2023-12153 · Jfinal · Jfinal

Name of the Vulnerable Software and Affected Versions: jFinal version 4.9.08 Description: A Server-Side Template Injection SSTI issue allows a remote attacker to execute arbitrary code via the template function. This enables the attacker to potentially gain control over the server. Recommendation...

CVE-2021-31635

Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...

CVE-2021-31635

CVE-2021-31635 : JFinal v4.9.08 contains a Server-Side Template Injection (SSTI) flaw in the template function that allows remote code execution. The NVD entry assigns a critical 9.8 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Public references and distributor entries (Red Hat, Veracode, GH...

JFinal 安全漏洞

JFinal is a Java language based WEB + ORM open source framework. A security vulnerability exists in JFinal version v.4.9.08, which originated from allowing remote attackers to execute arbitrary code via template functions...