CVE-2023-41599

CVE-2023-41599 : JFinalCMS v5.0.0 contains a directory traversal vulnerability in /common/DownController.java. Unauthenticated attackers can read arbitrary files from the server via path traversal in the filekey parameter, potentially exposing credentials and sensitive CMS content. The connected ...

CVE-2023-50100

CVE-2023-50100 affects JFinalcms 5.0.0. The vulnerability is a Cross-Site Scripting (XSS) flaw exposed via the carousel image editing feature, caused by insufficient filtering/escaping of user-supplied data. Impact: an attacker can inject and execute arbitrary scripts in the victim’s browser. Exp...

CVE-2023-50101

JFinalcms 5.0.0 is affected by a Cross-Site Scripting (XSS) vulnerability in the Label management editing feature. The issue is described across multiple sources (including Red Hat and Veracode feeds) as stemming from insufficient input validation in the library’s label management flow, enabling ...

CVE-2023-50137

CVE-2023-50137 : JFinalcms 5.0.0 is vulnerable to Cross-Site Scripting (XSS) in the site management office. The issue is documented across multiple feeds (NVD, Red Hat, Veracode, OSV, GHSA) with a base CVSS v3.1 score of 5.4 (Medium). The root cause is an XSS flaw in the site management office wh...

CVE-2023-49485

CVE-2023-49485 concerns JFinalCMS v5.0.0, with a cross-site scripting (XSS) vulnerability in the column management department. The original description and connected documents consistently identify the affected software as JFinalCMS v5.0.0 and attribute the issue to inadequate filtering/escaping ...

CVE-2023-50102

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) due to insufficient input sanitization, enabling injection of malicious JavaScript into a user’s browser. Affected component is the web content handling in JFinalcms; the root cause is input sanitization gaps. The reports do not provide ...

CVE-2024-22493

CVE-2024-22493 is a stored XSS vulnerability in JFinalcms 5.0.0 exploitable via the /gusetbook/save endpoint, specifically through the content parameter. Multiple connected sources confirm the same flaw and context, indicating that remote attackers can inject arbitrary script or HTML. The impact ...

CVE-2024-22494

CVE-2024-22494 is a stored XSS in JFinalcms 5.0.0 exploited via the /gusetbook/save mobile parameter. The vulnerability allows remote attackers to inject arbitrary web script or HTML into victims’ browsers due to improper input handling of the mobile field. Public details in the provided document...

CVE-2023-49486

JFinalCMS v5.0.0 is affected by a cross-site scripting (XSS) vulnerability in the model management department. The root cause is lack of effective filtering and escaping of user-supplied data. The vulnerability could allow attackers to execute arbitrary web scripts or HTML by injecting a crafted ...

CVE-2023-49487

CVE-2023-49487 concerns a cross-site scripting (XSS) vulnerability in JFinalCMS v5.0.0, located in the navigation management department. The root cause is insufficient filtering/escaping of user-supplied data, enabling arbitrary Web script or HTML execution. The CVSSv3.1 base score is 5.4 (Medium...

CVE-2023-50136

CVE-2023-50136 affects JFinalcms 5.0.0. The vulnerability is a Cross-Site Scripting (XSS) in the name field used when creating a new custom table, stemming from insufficient input filtering/escaping. Reported across multiple feeds (NVD/Red Hat/CNVD/CNNVD/etc.). Potential impact is execution of ar...

CVE-2024-22492

CVE-2024-22492 describes a stored XSS vulnerability in JFinalCMS 5.0.0. The issue is exploitable via the /gusetbook/save contact parameter, allowing remote attackers to inject arbitrary web script or HTML. The CVE entry notes a network-based vector with low attack complexity and requires user int...