jfinal cms 安全漏洞

jfinal cms is a java development of powerful information consulting website, using the simple and powerful JFinal as the web framework, template engine with beetl, database with mysql, front-end bootstrap framework. A security vulnerability exists in jfinal cms version 5.1.0. An attacker can...

CVE-2024-53477

CVE-2024-53477 affects JFinal CMS 5.1.0. The vulnerability is due to unauthorized deserialization in ApiForm.java, enabling remote command execution (described as a total impact on confidentiality, integrity, and availability with network attack vector and no user interaction). The CVSS v3.1 vect...

CVE-2024-53477

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...

PT-2024-35755 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue concerns the unauthorized execution of deserialization in the ApiForm.java file, leading to command execution. Recommendations: For JFinal CMS version 5.1.0, consider disabling the deserializati...

CVE-2024-53477

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...

CVE-2024-53477

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...

PT-2024-39248 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS versions up to 1.0 Description: A critical issue affects the delete function of the file /admin/template/edit. The manipulation of the name argument leads to path traversal, allowing an attacker to delete arbitrary files. This issue...

CVE-2024-8706

A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to...

PT-2023-31473 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: The issue is related to Cross Site Scripting XSS via Label management editing. This means an attacker could potentially inject malicious scripts into the website, affecting users who access the edited...

GHSA-9WVJ-WR2F-6MX6 Cross-Site Request Forgery in JFinalCMS

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/slide/save...

PT-2023-30467 · Jflyfox · Jfinalcms

Name of the Vulnerable Software and Affected Versions: jflyfox jfinalCMS version 5.1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the "login.jsp" component in the template management module. Recommendations: For jflyfox jfinalCMS version 5.1....

CVE-2023-34645

jfinal CMS 5.1.0 has an arbitrary file read vulnerability...

CVE-2023-34645

jfinal CMS 5.1.0 has an arbitrary file read vulnerability...

Arbitrary file deletion

jfinal CMS 5.1.0 has an arbitrary file read vulnerability...

CVE-2023-34645

CVE-2023-34645 affects jfinal CMS 5.1.0 with an arbitrary file read vulnerability. The initial documents report a HIGH severity (CVSS 7.5, NETWORK/LOW CW, no user interaction) and specify affected software, but do not provide the root cause details or a remediation in the supplied content. Multip...

CVE-2023-34645

jfinal CMS 5.1.0 has an arbitrary file read vulnerability...

CVE-2023-34645

jfinal CMS 5.1.0 has an arbitrary file read vulnerability...

CVE-2023-34645

jfinal CMS 5.1.0 has an arbitrary file read vulnerability...

GHSA-GH24-C683-79R2 Duplicate Advisory: Arbitrary code execution in jfinal CMS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8qhm-ch8h-xgjr. This link is maintained to preserve external references. Original Description Command execution vulnerability in the ActionEnter Class ins jfinal CMS version 5.1.0 allows attackers to execute...

PT-2023-20805 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: jfinal CMS version 5.1.0 Description: A command execution issue in the ActionEnter Class of jfinal CMS allows attackers to execute arbitrary code via a created json file to the ueditor route. Recommendations: For jfinal CMS version 5.1.0,...