CVE-2024-57768

JFinalOA, an enterprise office system based on the JFinal framework, contains a SQL injection vulnerability in versions prior to v2025.01.01 . The flaw exists in the validRoleKey?sysRole.key component, where insufficient neutralization of special elements allows for the injection of malicious SQL...

CVE-2024-57774

A cross-site scripting (XSS) vulnerability exists in the getBusinessUploadListPage?busid interface of JFinalOA versions prior to v2025.01.01 . The root cause is the improper neutralization of input during web page generation, which allows an attacker to execute arbitrary web scripts or HTML using...

CVE-2024-57771

The enterprise office system JFinalOA is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to v2025.01.01 . The vulnerability exists in the common/getEditPage?view interface, where a specially crafted payload allows an attacker to execute arbitrary web scripts or HTML in the victi...

CVE-2024-57769

CVE-2024-57769 affects JFinalOA prior to 2025.01.01, where a SQL injection flaw exists in the component borrowmoney/listData?applyUser . The issue is caused by improper handling of user input in this endpoint, enabling high-severity (C/H, I/H, A/H) impact per CVSS 3.1 with NETWORK attack vector, ...

CVE-2024-57776

A cross-site scripting (XSS) vulnerability exists in the JFinalOA enterprise office system in versions prior to v2025.01.01 . The flaw is located in the /apply/getEditPage?view interface, where a lack of proper input neutralization allows attackers to execute arbitrary web scripts or HTML via a c...

CVE-2024-57775

CVE-2024-57775 affects JFinalOA prior to v2025.01.01, with a SQL injection in the getWorkFlowHis?insid component. The vulnerability is documented across multiple feeds; impact is high (CVE CVSS 3.1: HIGH, network attack, no user interaction). A fix is indicated by the stated version boundary, sug...

CVE-2024-57772

A cross-site scripting (XSS) vulnerability exists in JFinalOA versions prior to v2025.01.01 . The flaw is located in the /bumph/getDraftListPage?type interface, where a crafted payload can allow attackers to execute arbitrary web scripts or HTML. To remediate this, users should update to version ...

CVE-2024-57770

CVE-2024-57770 affects JFinalOA prior to v2025.01.01, with a SQL injection vulnerability in the component apply/save#oaContractApply.id. The issue’s root cause is an input handling flaw that enables injectable SQL strings via that parameter, leading to potential confidentiality, integrity, and av...

CVE-2024-57773

A cross-site scripting (XSS) vulnerability exists in the openSelectManyUserPage?orgid interface of JFinalOA prior to version v2025.01.01 . This vulnerability allows an attacker to execute arbitrary web scripts or HTML by providing a crafted payload , which can lead to unauthorized actions on the ...