CVE-2023-49372

JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exploitable via the /admin/slide/save endpoint. Root cause is a CSRF weakness in that API path, as reported across multiple sources. CVSSv3.1 vector indicates high baseline impact (C/H, I/H, A/H) with no privileges ...

CVE-2023-49380

CVE-2023-49380: JFinalCMS v5.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/friend_link/delete endpoint. The issue is documented across multiple sources (NVD, GHSA, OSV, CVE list) with CVSSv3.1 base score 8.8 (HIGH), attack vector NETWORK, user interaction REQUIRED, ...

CVE-2023-49383

CVE-2023-49383 : JFinalCMS v5.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/tag/save endpoint. The issue is documented across multiple feeds (Red Hat, GHSA, OSV, NVD/CVE lists) and is characterized by a high-severity impact (CVSS v3.1: 8.8; Privileges Required: None...

CVE-2024-40322

The CVE-2024-40322 entry describes a SQL injection in JFinalCMS v5.0.0 exposed at the /admin/div_data/data API. Veracode notes improper input validation in DivDataController#data, enabling arbitrary SQL via manipulation of the tableName field in a custom div object. Red Hat/OSV and CVE databases ...

CVE-2023-49376

CVE-2023-49376 corresponds to a CSRF vulnerability affecting JFinalCMS v5.0.0, exploitable via the /admin/tag/delete endpoint. The NVD entry notes a high-severity vector (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8). Connected advisories also confirm the issue originates from CS...

CVE-2023-49398

JFinalCMS 5.0.0 contains a CSRF vulnerability exploitable via the /admin/category/delete endpoint. The CVE-2023-49398 entry notes CSRF with high impact (confidentiality/ integrity/ availability affected) and no exploitation details are provided in the connected documents. The linked PT-2023-31204...

CVE-2023-49381

CVE-2023-49381 affects JFinalCMS 5.0.0. The vulnerability is a Cross-Site Request Forgery (CSRF) in the /admin/div/update endpoint, allowing unintended actions within the application. The available connected document PT-2023-31196 specifies the affected software/version and confirms the CSRF natu...

CVE-2023-49382

Summary of findings for CVE-2023-49382 Affected software: JFinalCMS, version 5.0.0. Vulnerability: Cross-Site Request Forgery (CSRF) exposed via the /admin/div/delete API endpoint. Impact: CVSSv3.1 base score 8.8 (High). Impacts to confidentiality, integrity, and availability are all rated High i...

CVE-2023-49379

CVE-2023-49379 affects JFinalCMS v5.0.0. A CSRF in the /admin/friend_link/save component is described, with CVSS v3.1 base score 8.8 (HIGH) and user interaction required. The connected documents reiterate the same vulnerability; exploitation status and concrete remediation are not provided in the...

CVE-2023-49374

Concretely, CVE-2023-49374 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exploitable via /admin/slide/update. The NVD entry reports a CVSS v3.1 base score of 8.8 (High) with Network attack vector, no privileges required, user interaction required, and impacts to ...

CVE-2023-49447

Affected software and issue: JFinalCMS v5.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/nav/update component, due to insufficient validation of whether a request originates from a trusted user. Impact (as described): The vulnerability can enable an attacker to forge...

CVE-2023-49448

JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the admin/nav/delete endpoint. The CVE-2023-49448 entry identifies a CSRF issue with high impact to confidentiality, integrity, and availability (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No exploitation d...

CVE-2023-49375

CVE-2023-49375 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability via the /admin/friend_link/update endpoint. The NVD entry reports CVSS v3.1 base score 8.8 (HIGH) with network attack vector, no user privileges, and required user interaction. Multiple connected adviso...

CVE-2023-49373

CVE-2023-49373 : JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) at the /admin/slide/delete endpoint. The vulnerability arises at that API point, enabling unauthorized actions if a user with an active session is induced to perform a request. The CVSS3.1 metrics describe a High...

CVE-2023-49395

JFinalCMS v5.0.0 has a Cross-Site Request Forgery (CSRF) vulnerability in /admin/category/update. Root cause: CSRF in that endpoint. Impact: high (confidentiality, integrity, availability) per CVSS 3.1 (8.8). Exploitation details are not provided in the connected docs. Remediation: in the PT-2023...

CVE-2023-49396

CVE-2023-49396 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /admin/category/save endpoint. The issue originates from CSRF in how this endpoint handles requests, enabling potential unauthorized actions if a user is tricked into submitting a reques...

CVE-2023-49377

JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exploitable via /admin/tag/update. The CVE entry indicates a high-impact issue with CVSS 3.1: Network attack vector, no privileges required, user interaction required, and high impacts on confidentiality, integrity,...

CVE-2023-49446

Summary: CVE-2023-49446 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) issue exposed via the /admin/nav/save endpoint. The public dossier consistently identifies the vulnerability and its target, but does not provide a confirmed patch version or vendor remediation details. Root...

CVE-2023-49378

CVE-2023-49378 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /admin/form/save endpoint. Root cause: CSRF in that API path. Impact is high across confidentiality, integrity, and availability (per NVD metrics: CVSS 3.1 base score 8.8, HIGH). Connect...

CVE-2023-49397

JFinalCMS v5.0.0 contains a CSRF vulnerability exploitable via the /admin/category/updateStatus endpoint. Root cause: Cross-Site Request Forgery on a sensitive admin action. Impact is described as high (CVSS v3.1: 8.8; Confidentiality, Integrity, Availability all High). Exploitation details are n...