Jfinal Cms@5.1.0 Security Vulnerabilities and Issues — Jfinal Cms@5.1.0 CVE List

Lucene search

JflyfoxJfinal Cms5.1.0

39 matches found

CVE•added 2023/02/03 5:15 p.m.•108 views

CVE-2023-22975

A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html.

6.1CVSS5.8AI score0.00084EPSS

CVE•added 2022/06/23 5:15 p.m.•79 views

CVE-2022-33113

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.

5.4CVSS5.7AI score0.00181EPSS

CVE•added 2022/08/23 1:15 p.m.•75 views

CVE-2022-37199

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.

9.8CVSS9.8AI score0.00077EPSS

CVE•added 2022/04/11 3:15 p.m.•74 views

CVE-2022-27111

Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it.

5.4CVSS5.4AI score0.00181EPSS

CVE•added 2022/08/23 2:15 p.m.•74 views

CVE-2022-37223

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.

9.8CVSS9.8AI score0.00077EPSS

CVE•added 2022/05/03 5:15 p.m.•72 views

CVE-2022-28505

Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java.

7.2CVSS7.3AI score0.00242EPSS

CVE•added 2022/05/26 4:15 p.m.•68 views

CVE-2022-30500

Jfinal cms 5.1.0 is vulnerable to SQL Injection.

9.8CVSS9.6AI score0.00233EPSS

CVE•added 2022/06/02 2:15 p.m.•66 views

CVE-2022-29648

A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request.

5.4CVSS5.2AI score0.00181EPSS

CVE•added 2022/08/25 7:15 p.m.•66 views

CVE-2022-36527

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module.

5.4CVSS5.7AI score0.00099EPSS

CVE•added 2022/06/23 5:15 p.m.•52 views

CVE-2022-33114

Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list.

7.2CVSS7.2AI score0.00242EPSS

CVE•added 2022/10/26 6:15 p.m.•45 views

CVE-2022-37202

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list

8.8CVSS9.1AI score0.00459EPSS

CVE•added 2022/09/27 11:15 p.m.•44 views

CVE-2022-37209

JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.

8.8CVSS9.1AI score0.00459EPSS

CVE•added 2022/08/03 1:15 a.m.•43 views

CVE-2022-34928

JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.

8.8CVSS8.9AI score0.00078EPSS

CVE•added 2022/09/09 2:15 p.m.•43 views

CVE-2022-38279

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.

7.2CVSS7.3AI score0.00209EPSS

CVE•added 2022/09/09 2:15 p.m.•43 views

CVE-2022-38281

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.

7.2CVSS7.3AI score0.00209EPSS

CVE•added 2022/09/15 4:15 p.m.•41 views

CVE-2022-37201

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

8.8CVSS8.8AI score0.00463EPSS

CVE•added 2022/09/15 3:15 p.m.•41 views

CVE-2022-37207

JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection

8.8CVSS9.1AI score0.00463EPSS

CVE•added 2021/09/15 10:15 p.m.•40 views

CVE-2021-40639

Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.

7.5CVSS7.3AI score0.00291EPSS

CVE•added 2022/09/09 2:15 p.m.•40 views

CVE-2022-38274

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.

7.2CVSS7.3AI score0.00197EPSS

CVE•added 2022/09/20 5:15 p.m.•39 views

CVE-2022-37204

Final CMS 5.1.0 is vulnerable to SQL Injection.

9.8CVSS9.6AI score0.00463EPSS

CVE•added 2022/10/13 12:15 p.m.•39 views

CVE-2022-37208

JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.

8.8CVSS9AI score0.00459EPSS

CVE•added 2022/09/09 2:15 p.m.•39 views

CVE-2022-38283

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.

7.2CVSS7.3AI score0.0019EPSS

CVE•added 2022/09/09 2:15 p.m.•39 views

CVE-2022-38285

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.

7.2CVSS7.3AI score0.0019EPSS

CVE•added 2022/09/09 2:15 p.m.•38 views

CVE-2022-38278

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.

7.2CVSS7.3AI score0.00209EPSS

CVE•added 2021/12/16 7:15 p.m.•37 views

CVE-2021-37262

JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.

7.5CVSS7.6AI score0.00368EPSS

CVE•added 2022/09/19 4:15 p.m.•37 views

CVE-2022-37203

JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.

9.8CVSS9.8AI score0.00537EPSS

CVE•added 2022/09/09 2:15 p.m.•37 views

CVE-2022-38276

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.

7.2CVSS7.3AI score0.00197EPSS

CVE•added 2022/09/09 2:15 p.m.•37 views

CVE-2022-38277

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.

7.2CVSS7.3AI score0.00209EPSS

CVE•added 2022/09/09 2:15 p.m.•37 views

CVE-2022-38284

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.

7.2CVSS7.3AI score0.0019EPSS

CVE•added 2022/09/09 2:15 p.m.•37 views

CVE-2022-38286

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.

7.2CVSS7.3AI score0.0019EPSS

CVE•added 2023/04/27 2:15 p.m.•37 views

CVE-2023-30349

JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.

9.8CVSS9.8AI score0.02779EPSS

CVE•added 2022/09/09 2:15 p.m.•36 views

CVE-2022-38275

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.

7.2CVSS7.3AI score0.00209EPSS

CVE•added 2022/09/20 6:15 p.m.•35 views

CVE-2022-37205

JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.

8.8CVSS9.1AI score0.00463EPSS

CVE•added 2022/09/09 2:15 p.m.•35 views

CVE-2022-38272

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.

7.2CVSS7.3AI score0.00209EPSS

CVE•added 2022/09/09 2:15 p.m.•35 views

CVE-2022-38280

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.

7.2CVSS7.3AI score0.00209EPSS

CVE•added 2022/09/09 2:15 p.m.•34 views

CVE-2022-38273

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.

7.2CVSS7.3AI score0.00209EPSS

CVE•added 2023/06/16 6:15 p.m.•33 views

CVE-2023-34645

jfinal CMS 5.1.0 has an arbitrary file read vulnerability.

7.5CVSS7.5AI score0.00094EPSS

CVE•added 2022/09/09 2:15 p.m.•30 views

CVE-2022-38282

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.

7.2CVSS7.3AI score0.0019EPSS

CVE•added 2023/11/28 2:15 a.m.•25 views

CVE-2023-47503

An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module.

9.8CVSS9.5AI score0.01289EPSS