CVE-2023-22975

CVE-2023-22975 is a cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 where a crafted payload placed in the email parameter of the /front/person/profile.html endpoint can cause arbitrary web scripts/HTML to run in a user’s browser. RedHat/CNNVD/OSV/NVD entries corroborate the issue; r...

CVE-2024-53477

CVE-2024-53477 affects JFinal CMS 5.1.0. The vulnerability is due to unauthorized deserialization in ApiForm.java, enabling remote command execution (described as a total impact on confidentiality, integrity, and availability with network attack vector and no user interaction). The CVSS v3.1 vect...

CVE-2022-27111

CVE-2022-27111 affects Jfinal_CMS 5.1.0. The vulnerability is a cross-site scripting (XSS) flaw where the feedback feature can be abused to send malicious code to the administrator backend and have it executed. Root cause suggested by CNVD/CVE sources points to improper handling of user-supplied ...

CVE-2022-28505

CVE-2022-28505 affects Jfinal_cms 5.1.0. The vulnerability is a SQL Injection in the server-side code, specifically in com.jflyfox.system.log.LogController.java, caused by missing validation of external input SQL statements. Public documents indicate that exploitation could lead to unauthorized S...

CVE-2022-33113

CVE-2022-33113 affects Jfinal CMS v5.1.0. A cross-site scripting vulnerability allows an attacker to inject and trigger arbitrary JavaScript via a crafted payload in the keyword field of the Publish Blog module. The issue is documented across multiple feeds (including Red Hat, Veracode, CNVD and ...

CVE-2022-37199

JFinal CMS 5.1.0 is affected by an SQL Injection in the endpoint /jfinal_cms/system/user/list. Multiple connected sources (Red Hat CVE entry, GHSA advisory, OSV/NVD listings) corroborate that JFinal CMS 5.1.0 is vulnerable to SQL injection via that path. The CVE description consistently states th...

CVE-2021-42242

CVE-2021-42242 affects jfinal_cms 5.0.1; a command injection vulnerability exists via com.jflyfox.component.controller.Ueditor due to inadequate filtering of command-related characters, enabling arbitrary command execution. Descriptions across NVD, CNVD/CNNVD and OSV corroborate a remote command ...

CVE-2022-37223

JFinal CMS 5.1.0 is vulnerable to SQL Injection via the endpoint /jfinal_cms/system/role/list. The CVE-2022-37223 entry lists a CVSS v3.1 base score of 9.8 (CRITICAL) with network attack vector, no privileges required, and no user interaction. Affected component is the web application’s role-list...

CVE-2022-36527

CVE-2022-36527 affects Jfinal CMS v5.1.0. Multiple connected sources confirm a cross-site scripting (XSS) vulnerability where an attacker can inject arbitrary web scripts or HTML via a crafted payload into the post title text field under the publish blog module. The underlying issue is the handli...

CVE-2022-30500

Jfinal CMS 5.1.0 is vulnerable to SQL Injection. The root cause is a vulnerability in the getOrderby function where path components under /admin/ are directly spliced into SQL, enabling attackers to inject SQL. Available descriptions confirm the issue but do not provide a remediation or exploitat...

CVE-2022-29648

CVE-2022-29648 concerns Jfinal CMS v5.1.0 and describes a cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary web scripts or HTML by crafting the X-Forwarded-For header. The available connected documents consistently state the issue as XSS in X-Forwarded-For hand...

CVE-2021-37262

CVE-2021-37262 affects JFinal_cms 5.1.0. The vulnerability is a regex injection in handling user input, leading to Denial of Service. Multiple connected sources confirm the app/framework context and the nature of the issue, but no concrete exploit details or official fix/version remediation are p...

CVE-2022-33114

CVE-2022-33114 affects Jfinal CMS v5.1.0. A SQL injection vulnerability exists in the attrVal parameter used by /jfinal_cms/system/dict/list due to insufficient input validation, enabling potentially unauthorized SQL execution. Public records (NVD/NVD-derived entries, Red Hat) annotate this as a ...

CVE-2022-37208

Technical details about CVE-2022-37208 are not publicly available in the provided connected documents. The description notes SQL injection in JFinal CMS 5.1.0, but there are no concrete technical specifics, exploits, fixes, or affected components in the supplied sources. Monitor for updates.

CVE-2022-37202

CVE-2022-37202 affects JFinal CMS 5.1.0, where multiple interfaces (e.g., /admin/advicefeedback/list) expose SQL Injection due to unsafe SQL concatenation in distinct components. The CVSS 3.1 vector indicates NETWORK attack vector, LOW attack complexity, LOW privileges required, and high impact t...

CVE-2022-34928

CVE-2022-34928 affects JFinal CMS v5.1.0, where a SQL injection vulnerability exists in the /system/user endpoint. The issue is confirmed in multiple sources and is scored by NVD with CVSS 3.1: Network attack, Low attack complexity, Low privileges required, no user interaction, and a base score o...

CVE-2022-37205

CVE-2022-37205 affects JFinal CMS 5.1.0. SQL Injection stems from multiple interfaces using their own SQL concatenation without filters, enabling high-impact access (C/H, I/H, A/H) per CVSS 3.1. Exploitation PoC exists on GitHub (AgainstTheLight) and a related exploit repo is linked in the connec...

CVE-2023-30349

CVE-2023-30349 affects JFinal CMS v5.1.0; confirmed remote code execution via the ActionEnter function. The vulnerability is described as a high-severity (CVSS v3.1: 9.8) network‑based issue with no authentication required and no user interaction. The provided documents do not specify a fixed ver...

CVE-2022-37207

CVE-2022-37207 — JFinal CMS 5.1.0 is affected by SQL Injection. Interfaces do not share a common component and lack filtering; each uses its own SQL concatenation method, enabling injection. CVSS v3.1 base score 8.8 (High) with remote, low-complexity access and no user interaction; impact to conf...

CVE-2023-24747

CVE-2023-24747 affects Jfinal CMS v5.1, with a cross-site scripting (XSS) vulnerability exposed via the /system/dict/list endpoint. Public sources in the connected data confirm the issue is an XSS bug in that API component; no exploitation status is provided in the documents. The CVSSv3.1 base sc...

CVE-2022-37201

CVE-2022-37201 affects JFinal CMS 5.1.0. The Red Hat/NVD/etc indicate an SQL injection in multiple interfaces (e.g., /jfinal_cms/admin/contact/list and related id/name/menu-key paths) where SQL is directly concatenated without safe parameterization, enabling remote exploitation and potential data...

CVE-2022-37204

CVE-2022-37204 affects Final CMS 5.1.0 and is a SQL Injection vulnerability. The vulnerability stems from interfaces that concatenate SQL without proper safeguards, enabling remote exploitation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8). A PoC/exploit exists ...

CVE-2022-37209

CVE-2022-37209 affects JFinal CMS 5.1.0. The vulnerability is a SQL Injection caused by multiple interfaces not using the same component and lacking filters, with each interface using its own SQL concatenation method, enabling injection. CVSSv3.1 scores indicate high risk (8.8) with network attac...

CVE-2021-46087

CVE-2021-46087 corresponds to a stored XSS vulnerability in the JFinal CMS (jfinal_cms) with version qualification “>= 5.1.0” as described in the CVE summary. The vulnerability arises because the application does not filter user input from forms submitted in the background/administrative inter...

CVE-2022-38281

CVE-2022-38281 affects JFinal CMS 5.1.0; the vulnerability is a SQL injection in the /admin/site/list endpoint. Root cause: unsafely built SQL queries using user input. Impact as stated: potential data disclosure or modification with high severity (per CVSS 3.1). Remediation guidance from PT-2022...

CVE-2020-19154

The CVE-2020-19154 case concerns JFinal CMS (v4.7.1 and earlier) with an improper access control flaw in the FileManager.editFile() function of modules/filemanager/FileManagerController.java. The available documents state that this vulnerability allows remote attackers to obtain sensitive informa...

CVE-2021-40639

Summary: CVE-2021-40639 affects Jfinal CMS 5.1.0 due to improper access control that can let unauthenticated attackers access sensitive files, specifically /classes/conf/db.properties and config=filemanager.config.js. What is affected: Jfinal CMS 5.1.0; vulnerability scope described as improper a...

CVE-2022-37203

CVE-2022-37203 affects JFinal CMS 5.1.0. The vulnerability is a SQL injection arising because interfaces do not share a single component or apply uniform filters and each uses its own SQL concatenation method. Affected component/area is the web application interface layer of JFinal CMS, with the ...

CVE-2022-38275

JFinal CMS 5.1.0 is affected by an SQL Injection vulnerability exposed via the /admin/contact/list API endpoint. The issue stems from unsafely handled input in the API that leads to SQL injection, with a CVSS v3.1 base score of 7.2 (HIGH) in the NVD record. The PT-SECURITY advisory confirms the v...

CVE-2022-38274

JFinal CMS 5.1.0 is vulnerable to SQL Injection via the /admin/comment/list endpoint. The issue is a result of unsafe handling in the comment list API, enabling potentially malicious input to alter queries. The Red Hat, ENISA EUVD, OSV, NVD and CVE records all reflect this same description. The P...

CVE-2022-38279

JFinal CMS 5.1.0 is affected by a SQL Injection vulnerability exposed via the /admin/imagealbum/list endpoint. The issue is documented as CVE-2022-38279 with an impact profile indicating high severity (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The available connected sources confirm the aff...

CVE-2022-38277

CVE-2022-38277 affects JFinal CMS 5.1.0 . The flaw is a SQL Injection at the endpoint /admin/folderrollpicture/list caused by unsafe SQL handling. According to NVD, the impact is High (C/H/I/A) with a CVSS v3.1 base score 7.2 (Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The attack vector is net...

CVE-2020-19155

CVE-2020-19155 affects Jfinal CMS versions 4.7.1 and earlier. The vulnerability resides in the FileManager.rename() function (modules/filemanager/FileManagerController.java) due to improper access control, enabling remote attackers to obtain sensitive information and/or execute arbitrary code. Pu...

CVE-2022-38283

CVE-2022-38283 affects JFinal CMS 5.1.0, where the /admin/video/list endpoint is vulnerable to SQL injection due to improper input handling. The vulnerability is documented with a CVSS v3.1 base score of 7.2 (HIGH), impacting confidentiality, integrity, and availability. Remediation guidance avai...

CVE-2022-38285

CVE-2022-38285 concerns JFinal CMS 5.1.0, where the vulnerability is an SQL Injection in the /system/menu/list API endpoint. Root cause and impact are described across multiple sources as an injection flaw that can lead to high confidentiality, integrity, and availability impact. The NVD entry re...

CVE-2022-38284

CVE-2022-38284 affects JFinal CMS 5.1.0. The vulnerability is a SQL Injection exposed via the /system/department/list API endpoint, with a CVSS v3.1 base score of 7.2 (HIGH) and no user interaction required. A remediation path exists: upgrade to a newer JFinal CMS version that contains a fix (as ...

CVE-2020-19146

CVE-2020-19146 affects Jfinal CMS versions 4.7.1 and earlier, where an improper access control flaw in the component jfinal_cms/admin/folder/list allows remote attackers to obtain sensitive information via the TemplatePath parameter. Root cause: insufficient access checks on the affected path. Im...

CVE-2022-38273

JFinal CMS 5.1.0 is vulnerable to SQL Injection via the endpoint /admin/article/list_approve . The connected documents confirm this vulnerability but do not provide explicit exploit details or a fixed version. Remediation recommended: upgrade to a newer JFinal CMS version that contains a fix; no ...

CVE-2022-38272

CVE-2022-38272 affects JFinal CMS 5.1.0, with SQL Injection via the /admin/article/list endpoint. The connected sources confirm the vulnerability but do not provide explicit root-cause details in the documents; exploitation status is not described. PT-Security notes recommend updating JFinal CMS ...

CVE-2022-38278

Affected software & impact: JFinal CMS 5.1.0 is vulnerable to SQL Injection via the /admin/friendlylink/list endpoint. The vulnerability is documented across multiple sources, confirming the issue originates from that API path and involves improper handling of input that leads to SQL injection. R...

CVE-2022-38280

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. The root cause is improper handling of user input in SQL queries within the affected endpoint. The CVSS v3.1 base metrics indicate a High impact on confidentiality, integrity, and availability (7.2, HIGH) with network access r...

CVE-2022-38276

CVE-2022-38276 affects JFinal CMS 5.1.0 and is a SQL Injection vulnerability exploitable via the /admin/foldernotice/list endpoint. The root cause details are not fully described in the provided documents beyond the injection via that API path. The CVSSv3.1 base score is 7.2 (High) with Confident...

CVE-2020-19148

CVE-2020-19148 affects Jfinal CMS up to version 4.7.1. A Cross Site Scripting (XSS) flaw allows remote attackers to execute arbitrary code via the Nickname parameter in the /jfinal_cms/front/person/profile.html component. Exploitation details are not provided in the supplied documents, and no rem...

CVE-2022-38286

CVE-2022-38286 affects JFinal CMS 5.1.0 and is exploitable via the /system/role/list endpoint, enabling SQL injection. The provided sources consistently reference this endpoint vulnerability but do not publish a confirmed fixed version in the documents. CVSSv3.1 base score is 7.2 (High) with impa...

CVE-2023-34645

CVE-2023-34645 affects jfinal CMS 5.1.0 with an arbitrary file read vulnerability. The initial documents report a HIGH severity (CVSS 7.5, NETWORK/LOW CW, no user interaction) and specify affected software, but do not provide the root cause details or a remediation in the supplied content. Multip...

CVE-2020-19151

The CVE-2020-19151 entry concerns JFinal CMS (versions 4.7.1 and earlier) with a command injection flaw. The vulnerability arises when an attacker uploads a malicious HTML template file through the component jfinal_cms/admin/filemanager/list , enabling remote code execution. Affected software is ...

CVE-2022-38282

CVE-2022-38282 affects JFinal CMS 5.1.0 with a SQL Injection in the /admin/videoalbum/list endpoint. Root cause: unsanitized input in that API path leads to injection. Impact per sources is consistent with high severity; no exploitation details are provided in the documents. Remediation: update t...

CVE-2020-19147

CVE-2020-19147 affects Jfinal CMS versions 4.7.1 and earlier. The issue is improper access control in the file manager, specifically the getFolder() function in /modules/filemanager/FileManager.java, which allows remote attackers to obtain sensitive information. Documentation across multiple sour...

CVE-2020-19150

The CVE-2020-19150 entry concerns Jfinal CMS (versions 4.7.1 and earlier) with an improper access control flaw in the FileManager.delete() function (modules/filemanager/FileManagerController.java). The vulnerability permits remote attackers to obtain sensitive information or cause a denial of ser...

CVE-2023-47503

CVE-2023-47503 affects jflyfox jfinalCMS v5.1.0. Root cause: login.jsp in the template management module not properly restricted, enabling remote attackers to execute arbitrary code via a crafted script. Documented impact is arbitrary code execution with high severity (NVD CVSS 3.1 base score 9.8...