jflyfox

Records52All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high30CVSS 7.0–8.9

Exploited now

jflyfox records in CISA KEV

No jflyfox vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Jfinal Cms 51 records HIGH

Records

52 records

TI-2023-14235 CVE-2023-30349 · GHSA-8qhm-ch8h-xgjr

JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.

HIGH 82

JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01562 Published 2023-04-27 No fix listed CWE-94

TI-2022-17345 CVE-2022-37204 · GHSA-hqmx-w3x7-2p3v

Final CMS 5.1.0 is vulnerable to SQL Injection.

HIGH 82

Final CMS 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0147 Published 2022-09-20 No fix listed CWE-89

TI-2022-17348 CVE-2022-37208 · GHSA-h6jv-fj7r-v2m5

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

HIGH 73

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01538 Published 2022-10-13 No fix listed CWE-89

TI-2022-17346 CVE-2022-37205 · GHSA-6m76-235x-7w53

JFinal CMS 5.1.0 is affected by: SQL Injection.

HIGH 73

JFinal CMS 5.1.0 is affected by: SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01587 Published 2022-09-20 No fix listed CWE-89

TI-2022-17343 CVE-2022-37202 · GHSA-38vr-r7mr-r99m

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list

HIGH 73

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01406 Published 2022-10-26 No fix listed CWE-89

TI-2023-17357 CVE-2023-34645 · GHSA-mv2p-xxqx-rg9j

jfinal CMS 5.1.0 has an arbitrary file read vulnerability.

HIGH 72

jfinal CMS 5.1.0 has an arbitrary file read vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00799 Published 2023-06-16 No fix listed CWE-22

TI-2025-05515 CVE-2025-6105 · GHSA-mm3c-hg42-7xq9

jflyfox jfinal_cms HOME.java cross-site request forgery

MEDIUM 57

A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00309 Published 2025-06-16 No fix listed CWE-352

TI-2024-35814 CVE-2024-53477 · GHSA-x5rh-6m69-mwg4

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of…

MEDIUM 50

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00878 Published 2024-12-02 No fix listed CWE-502

TI-2020-13543 CVE-2020-19155 · GHSA-9m22-6q82-m684

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to…

MEDIUM 48

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07522 Published 2021-09-15 No fix listed CWE-668

TI-2021-18688 CVE-2021-42242 · GHSA-rx98-g9m2-9j9f

A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor.

MEDIUM 46

A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02173 Published 2022-05-05 No fix listed

TI-2020-13541 CVE-2020-19151 · GHSA-v2cc-8mqc-vmq4

Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute…

MEDIUM 46

Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05031 Published 2021-09-15 No fix listed CWE-77

TI-2023-25674 CVE-2023-47503 · GHSA-2jxw-7f5p-jwg5

An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code…

MEDIUM 45

An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01273 Published 2023-11-28 No fix listed

TI-2022-17344 CVE-2022-37203 · GHSA-hqvp-grxx-fxfg

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

MEDIUM 45

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01664 Published 2022-09-19 No fix listed CWE-89

TI-2022-17350 CVE-2022-37223 · GHSA-wv39-f3vx-3v6q

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.

MEDIUM 44

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00921 Published 2022-08-23 No fix listed CWE-89

TI-2022-17341 CVE-2022-37199 · GHSA-5rf4-f24c-hpvh

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.

MEDIUM 44

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00921 Published 2022-08-23 No fix listed CWE-89

TI-2022-12664 CVE-2022-30500 · GHSA-595x-hh6c-hfv8

Jfinal cms 5.1.0 is vulnerable to SQL Injection.

MEDIUM 44

Jfinal cms 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0108 Published 2022-05-26 No fix listed CWE-89

TI-2022-17349 CVE-2022-37209 · GHSA-p44g-35x8-7hjv

JFinal CMS 5.1.0 is affected by: SQL Injection.

MEDIUM 43

JFinal CMS 5.1.0 is affected by: SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01586 Published 2022-09-27 No fix listed CWE-89

TI-2022-17347 CVE-2022-37207 · GHSA-x9v2-5wgg-m7jr

JFinal CMS 5.1.0 is affected by: SQL Injection.

MEDIUM 41

JFinal CMS 5.1.0 is affected by: SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01587 Published 2022-09-15 No fix listed CWE-89

TI-2022-17342 CVE-2022-37201 · GHSA-cm58-r8g4-7v26

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

MEDIUM 41

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01587 Published 2022-09-15 No fix listed CWE-89

TI-2020-13540 CVE-2020-19150 · GHSA-x6jw-674q-3wx8

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to…

MEDIUM 41

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0349 Published 2021-09-15 No fix listed CWE-22

TI-2022-15711 CVE-2022-34928 · GHSA-mh2j-92x8-gxp5

JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.

MEDIUM 40

JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00921 Published 2022-08-03 No fix listed CWE-89

TI-2021-17621 CVE-2021-40639 · GHSA-8m3p-xv8v-vgp2

Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive…

LOW 35

Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01198 Published 2021-09-15 No fix listed CWE-668

TI-2021-15289 CVE-2021-37262 · GHSA-qfw2-4mg3-rwff

JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.

LOW 35

JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01044 Published 2021-12-16 No fix listed CWE-74

TI-2020-13542 CVE-2020-19154 · GHSA-29h6-3fpg-r7jh

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to…

LOW 35

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03876 Published 2021-09-15 No fix listed CWE-22

TI-2022-17950 CVE-2022-38286 · GHSA-fmpf-9cgm-x935

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

Open these records in search →