CVE-2024-22497

CVE-2024-22497 : A cross-site scripting (XSS) vulnerability affects JFinalcms 5.0.0, arising from handling of the password parameter in the /admin/login route. Exploitation via crafted URLs may allow an attacker to run arbitrary code. Multiple feeds (NVD, Red Hat, Veracode, OSV, GHSA, CNNVD, CVE ...

CVE-2024-22496

CVE-2024-22496 is an XSS vulnerability affecting JFinalcms 5.0.0. The issue stems from improper handling of the /admin/login username parameter, enabling injection of arbitrary JavaScript code. Connected sources corroborate the vulnerability as Cross-site Scripting in JFinalcms with the same vect...

CVE-2023-51254

Jfinalcms 5.0.0 is affected by a Cross Site Scripting (XSS) flaw in the friendship link component. The weakness stems from inadequate input validation, allowing a remote attacker to inject script and potentially execute arbitrary code. Documented by multiple sources (Veracode, CNNVD, OSV, Red Hat...