JFinalCMS Security Vulnerability

JFinalCMS is a content management system developed by heyewei. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/category/updateStatus component...

CVE-2023-49374

Concretely, CVE-2023-49374 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exploitable via /admin/slide/update. The NVD entry reports a CVSS v3.1 base score of 8.8 (High) with Network attack vector, no privileges required, user interaction required, and impacts to ...

CVE-2023-49378

CVE-2023-49378 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /admin/form/save endpoint. Root cause: CSRF in that API path. Impact is high across confidentiality, integrity, and availability (per NVD metrics: CVSS 3.1 base score 8.8, HIGH). Connect...

CVE-2023-49378: Cross-Site Request Forgery (CSRF)

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/form/save...

CVE-2023-49382: Cross-Site Request Forgery (CSRF)

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/div/delete...

CVE-2023-49380

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/friendlink/delete...

CVE-2023-49398

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/delete...

JFinalCMS Security Vulnerability

JFinalCMS is a content management system developed by heyewei. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/category/delete component...

CVE-2023-49372

JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exploitable via the /admin/slide/save endpoint. Root cause is a CSRF weakness in that API path, as reported across multiple sources. CVSSv3.1 vector indicates high baseline impact (C/H, I/H, A/H) with no privileges ...

CVE-2023-49373

CVE-2023-49373 : JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) at the /admin/slide/delete endpoint. The vulnerability arises at that API point, enabling unauthorized actions if a user with an active session is induced to perform a request. The CVSS3.1 metrics describe a High...

CVE-2023-49375

CVE-2023-49375 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability via the /admin/friend_link/update endpoint. The NVD entry reports CVSS v3.1 base score 8.8 (HIGH) with network attack vector, no user privileges, and required user interaction. Multiple connected adviso...

CVE-2023-49379

CVE-2023-49379 affects JFinalCMS v5.0.0. A CSRF in the /admin/friend_link/save component is described, with CVSS v3.1 base score 8.8 (HIGH) and user interaction required. The connected documents reiterate the same vulnerability; exploitation status and concrete remediation are not provided in the...

CVE-2023-49446

Summary: CVE-2023-49446 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) issue exposed via the /admin/nav/save endpoint. The public dossier consistently identifies the vulnerability and its target, but does not provide a confirmed patch version or vendor remediation details. Root...

CVE-2023-49381

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/div/update...

CVE-2023-49396

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/save...

CVE-2023-49447

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/nav/update...

CVE-2023-49377

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/tag/update...

CVE-2023-47503

An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module...

CVE-2023-47503

An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module...

jfinalCMS Security Vulnerabilities

JFinalCMS is a content management system by heyewei personal developer. A security vulnerability exists in jfinalCMS version v.5.1.0, which originated from a vulnerability that allows remote attackers to execute arbitrary code via a crafted script...