Vulnerabilities

TI-2021-11722 CVE-2021-31635 · GHSA-cgmm-c2m9-ff7r

Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote…

MEDIUM 51

Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01206 Published 2023-06-26 No fix listed CWE-94

TI-2021-11729 CVE-2021-31649 · GHSA-h3j8-fr5q-8rfr

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability…

MEDIUM 46

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0182 Published 2021-06-24 No fix listed CWE-502

TI-2021-12815 CVE-2021-33348 · GHSA-2c25-xfpq-8w9r

An issue was discovered in JFinal framework v4.9.10 and below.

LOW 28

An issue was discovered in JFinal framework v4.9.10 and below.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2021-06-24 Fixed in 4.9.11 CWE-79

TI-2019-12950 CVE-2019-17352 · GHSA-279p-pc38-xx4p

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can…

LOW 36

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01743 Published 2019-10-08 Fixed in 4.5 CWE-434

Vulnerabilities

Filters

Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote…

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability…

An issue was discovered in JFinal framework v4.9.10 and below.

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can…