CVE-2025-3214

CVE-2025-3214 affects JFinal CMS up to version 5.2.4. The vulnerability resides in the readTemplate function’s engine.getTemplate, where manipulating the template argument enables path traversal. Exploitation can be remote, and public proofs exist, but the real existence of the vulnerability is d...

The vulnerability of the /admin/tag/save file in the Jfinal CMS system allows a attacker to perform a CSRF attack.

The vulnerability of the /admin/tag/save file in the Jfinal CMS system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

The vulnerability of the TemplateHandler component in the \src\main\java\com\cms\controller\admin\TemplateController.java file of the Jfinal CMS content management system allows a hacker to execute arbitrary code.

The vulnerability of the TemplateHandler component in the \src\main\java\com\cms\controller\admin\TemplateController.java file of the Jfinal CMS content management system is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

PT-2024-17558 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 1.0 Description: The issue is related to a cross-site request forgery CSRF vulnerability in the /admin/tag/save file of the JFinalCMS system. This vulnerability can be exploited remotely, allowing an attacker to perform a CS...

CVE-2024-53477

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...

CVE-2024-53477

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...

CVE-2024-53477

CVE-2024-53477 affects JFinal CMS 5.1.0. The vulnerability is due to unauthorized deserialization in ApiForm.java, enabling remote command execution (described as a total impact on confidentiality, integrity, and availability with network attack vector and no user interaction). The CVSS v3.1 vect...

CVE-2024-53477

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...

PT-2024-35755 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinal CMS version 5.1.0 Description: The issue concerns the unauthorized execution of deserialization in the ApiForm.java file, leading to command execution. Recommendations: For JFinal CMS version 5.1.0, consider disabling the deserializati...

CVE-2024-53477

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java...

jfinal cms 安全漏洞

jfinal cms is a java development of powerful information consulting website, using the simple and powerful JFinal as the web framework, template engine with beetl, database with mysql, front-end bootstrap framework. A security vulnerability exists in jfinal cms version 5.1.0. An attacker can...

PT-2024-39248 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS versions up to 1.0 Description: A critical issue affects the delete function of the file /admin/template/edit. The manipulation of the name argument leads to path traversal, allowing an attacker to delete arbitrary files. This issue...

CVE-2024-8706

A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to...

Cross-Site Scripting (XSS)

com.jfinal, jfinal is vulnerable to Cross-site scripting. The vulnerability is due to improper input validation in the Title parameter in the /admin/content file, which can be manipulated to inject malicious scripts. Attackers can exploit this vulnerability remotely to execute arbitrary scripts i...

SQL Injection

com.jfinal, jfinal is vulnerable to SQL injection. The vulnerability is due to improper input validation in the DivDataControllerdata method, allowing attackers to execute arbitrary SQL commands by manipulating the tableName field of a custom div object. Attackers can exploit this flaw by creatin...

Cross Site Scripting (XSS)

com.jfinal: jfinal is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper handling of the password parameter within the /admin/login route . This allows attackers to execute arbitrary code via crafted malicious URLs, resulting in Cross-Site Scripting...

JFinal Cross-Site Scripting Vulnerability

JFinal is a Java language based WEB + ORM open source framework. A cross-site scripting vulnerability exists in JFinal version 5.0.0, which originates from allowing an attacker to run arbitrary code via the /admin/login password parameter...

JFinal Cross-Site Scripting Vulnerability

JFinal is a Java language based WEB + ORM open source framework. A cross-site scripting vulnerability exists in JFinal version 5.0.0, which originates from allowing an attacker to run arbitrary code via the /admin/login username parameter...

Cross-site Scripting in JFinal

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML...

Cross Site Scripting (XSS)

com.jfinal:jfinal is vulnerable to Cross-site Scripting XSS. The vulnerability occurs due to insufficient user input sanitizations, which allows an authenticated attacker to inject and execute malicious javascript into the victim's browser...