Vulnerabilities

TI-2025-05515 CVE-2025-6105 · GHSA-mm3c-hg42-7xq9

jflyfox jfinal_cms HOME.java cross-site request forgery

MEDIUM 57

A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00309 Published 2025-06-16 No fix listed CWE-352

TI-2024-35814 CVE-2024-53477 · GHSA-x5rh-6m69-mwg4

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of…

MEDIUM 50

JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00878 Published 2024-12-02 No fix listed CWE-502

TI-2023-25674 CVE-2023-47503 · GHSA-2jxw-7f5p-jwg5

An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code…

MEDIUM 45

An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01273 Published 2023-11-28 No fix listed

TI-2023-17357 CVE-2023-34645 · GHSA-mv2p-xxqx-rg9j

jfinal CMS 5.1.0 has an arbitrary file read vulnerability.

HIGH 72

jfinal CMS 5.1.0 has an arbitrary file read vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00799 Published 2023-06-16 No fix listed CWE-22

TI-2023-14235 CVE-2023-30349 · GHSA-8qhm-ch8h-xgjr

JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.

HIGH 82

JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01562 Published 2023-04-27 No fix listed CWE-94

TI-2023-10276 CVE-2023-24747 · GHSA-q58v-rgw7-36q6

Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via…

LOW 25

Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00373 Published 2023-04-05 No fix listed CWE-79

TI-2023-09098 CVE-2023-22975 · GHSA-mc6r-96x5-5c53

A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to…

LOW 28

A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00423 Published 2023-02-03 No fix listed CWE-79

TI-2022-17343 CVE-2022-37202 · GHSA-38vr-r7mr-r99m

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list

HIGH 73

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01406 Published 2022-10-26 No fix listed CWE-89

TI-2022-17348 CVE-2022-37208 · GHSA-h6jv-fj7r-v2m5

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

HIGH 73

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01538 Published 2022-10-13 No fix listed CWE-89

TI-2022-17349 CVE-2022-37209 · GHSA-p44g-35x8-7hjv

JFinal CMS 5.1.0 is affected by: SQL Injection.

MEDIUM 43

JFinal CMS 5.1.0 is affected by: SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01586 Published 2022-09-27 No fix listed CWE-89

TI-2022-17346 CVE-2022-37205 · GHSA-6m76-235x-7w53

JFinal CMS 5.1.0 is affected by: SQL Injection.

HIGH 73

JFinal CMS 5.1.0 is affected by: SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01587 Published 2022-09-20 No fix listed CWE-89

TI-2022-17345 CVE-2022-37204 · GHSA-hqmx-w3x7-2p3v

Final CMS 5.1.0 is vulnerable to SQL Injection.

HIGH 82

Final CMS 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0147 Published 2022-09-20 No fix listed CWE-89

TI-2022-17344 CVE-2022-37203 · GHSA-hqvp-grxx-fxfg

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

MEDIUM 45

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01664 Published 2022-09-19 No fix listed CWE-89

TI-2022-17342 CVE-2022-37201 · GHSA-cm58-r8g4-7v26

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

MEDIUM 41

JFinal CMS 5.1.0 is vulnerable to SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01587 Published 2022-09-15 No fix listed CWE-89

TI-2022-17347 CVE-2022-37207 · GHSA-x9v2-5wgg-m7jr

JFinal CMS 5.1.0 is affected by: SQL Injection.

MEDIUM 41

JFinal CMS 5.1.0 is affected by: SQL Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01587 Published 2022-09-15 No fix listed CWE-89

TI-2022-17938 CVE-2022-38274 · GHSA-c4f6-pc3f-7jhf

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

TI-2022-17937 CVE-2022-38273 · GHSA-mvj9-47mw-8q86

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

TI-2022-17936 CVE-2022-38272 · GHSA-j8pp-5w5q-mvm2

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

TI-2022-17939 CVE-2022-38275 · GHSA-xhh6-mvw9-x97w

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01238 Published 2022-09-09 No fix listed CWE-89

TI-2022-17941 CVE-2022-38277 · GHSA-97f4-hh2x-jgjc

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

TI-2022-17940 CVE-2022-38276 · GHSA-hr98-58mc-jr6g

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

TI-2022-17942 CVE-2022-38278 · GHSA-98jp-p3gg-mpx9

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01238 Published 2022-09-09 No fix listed CWE-89

TI-2022-17943 CVE-2022-38279 · GHSA-75v5-m5v3-chjw

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

TI-2022-17945 CVE-2022-38281 · GHSA-8899-h3r7-hrjp

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

TI-2022-17944 CVE-2022-38280 · GHSA-r6h5-h9g2-q9q9

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.

LOW 34

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01075 Published 2022-09-09 No fix listed CWE-89

Vulnerabilities

Filters