TI-2025-02813 CVE-2025-3214 · GHSA-g9jw-53r4-8v8g
JFinal CMS readTemplate engine.getTemplate path traversal
Priority MEDIUM 57
A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic.
JFinal
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
JFinal records in CISA KEVNo JFinal vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2021-11722 CVE-2021-31635 · GHSA-cgmm-c2m9-ff7r
Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote…
Priority MEDIUM 51
Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.
TI-2021-11729 CVE-2021-31649 · GHSA-h3j8-fr5q-8rfr
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability…
Priority MEDIUM 46
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute
TI-2019-12950 CVE-2019-17352 · GHSA-279p-pc38-xx4p
In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can…
Priority LOW 36
In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file.
TI-2021-12815 CVE-2021-33348 · GHSA-2c25-xfpq-8w9r
An issue was discovered in JFinal framework v4.9.10 and below.
Priority LOW 28
An issue was discovered in JFinal framework v4.9.10 and below.