CVE-2024-57768

JFinalOA, an enterprise office system based on the JFinal framework, contains a SQL injection vulnerability in versions prior to v2025.01.01 . The flaw exists in the validRoleKey?sysRole.key component, where insufficient neutralization of special elements allows for the injection of malicious SQL...

CVE-2024-57774

A cross-site scripting (XSS) vulnerability exists in the getBusinessUploadListPage?busid interface of JFinalOA versions prior to v2025.01.01 . The root cause is the improper neutralization of input during web page generation, which allows an attacker to execute arbitrary web scripts or HTML using...

CVE-2021-40645

glorylion JFinalOA contains an SQL injection in the defkey parameter of FlowTaskController.getHaveDoneTaskDataList. The root cause is improper handling of the defkey input, enabling arbitrary SQL execution with potential HIGH confidentiality impact. Affected versions/details are not provided in t...

CVE-2024-57771

The enterprise office system JFinalOA is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to v2025.01.01 . The vulnerability exists in the common/getEditPage?view interface, where a specially crafted payload allows an attacker to execute arbitrary web scripts or HTML in the victi...

CVE-2023-0758

CVE-2023-0758 affects glorylion JFinalOA 1.0.2. A SQL injection flaw arises from the id parameter in SysOrg.java (src/main/java/com/pointlion/mvc/common/model/SysOrg.java). The issue can be exploited remotely and leads to high impact on confidentiality, integrity, and availability. Multiple conne...

CVE-2024-57769

CVE-2024-57769 affects JFinalOA prior to 2025.01.01, where a SQL injection flaw exists in the component borrowmoney/listData?applyUser . The issue is caused by improper handling of user input in this endpoint, enabling high-severity (C/H, I/H, A/H) impact per CVSS 3.1 with NETWORK attack vector, ...

CVE-2024-57776

A cross-site scripting (XSS) vulnerability exists in the JFinalOA enterprise office system in versions prior to v2025.01.01 . The flaw is located in the /apply/getEditPage?view interface, where a lack of proper input neutralization allows attackers to execute arbitrary web scripts or HTML via a c...

CVE-2024-57772

A cross-site scripting (XSS) vulnerability exists in JFinalOA versions prior to v2025.01.01 . The flaw is located in the /bumph/getDraftListPage?type interface, where a crafted payload can allow attackers to execute arbitrary web scripts or HTML. To remediate this, users should update to version ...

CVE-2024-57775

CVE-2024-57775 affects JFinalOA prior to v2025.01.01, with a SQL injection in the getWorkFlowHis?insid component. The vulnerability is documented across multiple feeds; impact is high (CVE CVSS 3.1: HIGH, network attack, no user interaction). A fix is indicated by the stated version boundary, sug...

CVE-2024-57770

CVE-2024-57770 affects JFinalOA prior to v2025.01.01, with a SQL injection vulnerability in the component apply/save#oaContractApply.id. The issue’s root cause is an input handling flaw that enables injectable SQL strings via that parameter, leading to potential confidentiality, integrity, and av...

CVE-2024-57773

A cross-site scripting (XSS) vulnerability exists in the openSelectManyUserPage?orgid interface of JFinalOA prior to version v2025.01.01 . This vulnerability allows an attacker to execute arbitrary web scripts or HTML by providing a crafted payload , which can lead to unauthorized actions on the ...