CVE-2024-24375

CVE-2024-24375 describes a SQL injection in Jfinalcms v5.0.0 that allows a remote attacker to obtain sensitive information through the /admin/admin name parameter. Multiple vendors and feeds (NVD, Red Hat, OSV, CNNVD, CVE list) corroborate a vulnerability centered on the /admin/admin name endpoin...

CVE-2023-50449

Summary (CVE-2023-50449): JFinalCMS 5.0.0 is vulnerable to a remote directory traversal via the /common/down/file fileKey parameter, allowing reading of arbitrary files. Root cause: improper handling of the ../ path segment in the fileKey parameter. Documented by multiple sources (Red Hat, GHSA, ...