Jfinal Cms@* Security Vulnerabilities and Issues — Jfinal Cms@* CVE List

Lucene search

JflyfoxJfinal Cms*

8 matches found

CVE•added 2022/01/25 4:15 p.m.•39 views

CVE-2021-46087

In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code.

5.4CVSS5.3AI score0.00191EPSS

CVE•added 2021/09/15 2:15 p.m.•37 views

CVE-2020-19155

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'.

8.8CVSS8.8AI score0.03188EPSS

CVE•added 2021/09/15 2:15 p.m.•35 views

CVE-2020-19146

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'.

6.5CVSS6.3AI score0.00189EPSS

CVE•added 2021/09/15 2:15 p.m.•34 views

CVE-2020-19148

Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/jfinal_cms/front/person/profile.html'.

5.4CVSS5.7AI score0.00505EPSS

CVE•added 2021/09/15 2:15 p.m.•32 views

CVE-2020-19151

Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'.

8.8CVSS9.1AI score0.02469EPSS

CVE•added 2021/09/15 2:15 p.m.•31 views

CVE-2020-19147

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'.

6.5CVSS6.4AI score0.00289EPSS

CVE•added 2021/09/15 2:15 p.m.•30 views

CVE-2020-19150

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'.

8.1CVSS7.9AI score0.00584EPSS

CVE•added 2021/09/15 2:15 p.m.•30 views

CVE-2020-19154

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'.

6.5CVSS6.2AI score0.00257EPSS