Vendors / JFinal Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 1
Exploited now JFinal records in CISA KEV No JFinal vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 51
Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01206 · Published 2023-06-26 · No fix listed CWE-94
Priority MEDIUM 46
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0182 · Published 2021-06-24 · No fix listed CWE-502
Priority LOW 36
In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01743 · Published 2019-10-08 · Fixed in 4.5 CWE-434
Priority LOW 28
An issue was discovered in JFinal framework v4.9.10 and below.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00641 · Published 2021-06-24 · Fixed in 4.9.11 CWE-79
Open these records in search → All records by CVSS severity
2 1 2 0 0
THREATIST.IORead the docs