Jfinalcms Project

Records39All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high22CVSS 7.0–8.9

Exploited now

Jfinalcms Project records in CISA KEV

No Jfinalcms Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Jfinalcms 39 records HIGH

Records

39 records in Jfinalcms · all components

TI-2024-15981 CVE-2024-24029 · GHSA-vrq4-9579-qc8m

JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.

HIGH 82

JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00761 Published 2024-02-02 No fix listed CWE-89

TI-2024-16097 CVE-2024-24375 · GHSA-r84c-86vg-4c66

SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain…

HIGH 72

SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00485 Published 2024-03-07 No fix listed CWE-312

TI-2024-26889 CVE-2024-40322 · GHSA-6rhc-84wg-83gv

An issue was discovered in JFinalCMS v.5.0.0.

HIGH 71

An issue was discovered in JFinalCMS v.5.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00433 Published 2024-07-16 No fix listed CWE-89

TI-2023-22044 CVE-2023-41599 · GHSA-g57g-8xw6-gwrx

An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows…

MEDIUM 63

An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.12364 Published 2023-09-19 No fix listed CWE-22

TI-2024-15043 CVE-2024-22497 · GHSA-qh2w-9m7w-hjg2

Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00435 Published 2024-01-23 No fix listed CWE-79

TI-2024-15042 CVE-2024-22496 · GHSA-v435-pfj6-68r3

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00435 Published 2024-01-23 No fix listed CWE-79

TI-2023-27962 CVE-2023-51254 · GHSA-84cf-cm69-mj8w

Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to…

MEDIUM 60

Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00552 Published 2024-04-29 No fix listed CWE-79

TI-2024-15041 CVE-2024-22494 · GHSA-6r88-ph68-rhgv

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile…

MEDIUM 58

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00466 Published 2024-01-12 No fix listed CWE-79

TI-2024-15040 CVE-2024-22493 · GHSA-3j4x-9q9q-3277

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content…

MEDIUM 58

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00556 Published 2024-01-12 No fix listed CWE-79

TI-2024-15039 CVE-2024-22492 · GHSA-859h-4w58-78xw

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact…

MEDIUM 58

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00556 Published 2024-01-12 No fix listed CWE-79

TI-2023-27401 CVE-2023-50136 · GHSA-39hm-h746-p544

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00408 Published 2024-01-09 No fix listed CWE-79

TI-2022-10414 CVE-2022-27341 · GHSA-p3r6-m6q9-hhj4

JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.

MEDIUM 45

JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01239 Published 2022-04-22 No fix listed CWE-89

TI-2023-27018 CVE-2023-49448 · GHSA-pv3g-vc3q-8c9g

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-27017 CVE-2023-49447 · GHSA-32j2-c7mx-v4jj

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-27016 CVE-2023-49446 · GHSA-hv4c-v8j8-54cw

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26984 CVE-2023-49398 · GHSA-mwvq-gc5w-m78f

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26983 CVE-2023-49397 · GHSA-5f56-h6fg-rcrh

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF)…

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26982 CVE-2023-49396 · GHSA-882g-gjqp-9vjp

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26981 CVE-2023-49395 · GHSA-8hch-q86g-j38w

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26978 CVE-2023-49383 · GHSA-rq2q-hc6h-2px2

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26977 CVE-2023-49382 · GHSA-6v55-h6m5-2352

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26976 CVE-2023-49381 · GHSA-r222-mcff-27ff

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26975 CVE-2023-49380 · GHSA-765f-3mgx-24pw

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF)…

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

TI-2023-26974 CVE-2023-49379 · GHSA-r2wj-mxvh-wqfh

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF)…

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00405 Published 2023-12-05 No fix listed CWE-352

TI-2023-26973 CVE-2023-49378 · GHSA-gw26-cchc-8f2f

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00391 Published 2023-12-05 No fix listed CWE-352

Open these records in search →

Critical	2
High	22
Medium	15
Low	0
No CVSS	0