Vulnerabilities

TI-2024-26889 CVE-2024-40322 · GHSA-6rhc-84wg-83gv

An issue was discovered in JFinalCMS v.5.0.0.

HIGH 71

An issue was discovered in JFinalCMS v.5.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00433 Published 2024-07-16 No fix listed CWE-89

TI-2023-27962 CVE-2023-51254 · GHSA-84cf-cm69-mj8w

Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to…

MEDIUM 60

Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00552 Published 2024-04-29 No fix listed CWE-79

TI-2024-16097 CVE-2024-24375 · GHSA-r84c-86vg-4c66

SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain…

HIGH 72

SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00485 Published 2024-03-07 No fix listed CWE-312

TI-2024-15981 CVE-2024-24029 · GHSA-vrq4-9579-qc8m

JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.

HIGH 82

JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00761 Published 2024-02-02 No fix listed CWE-89

TI-2024-15043 CVE-2024-22497 · GHSA-qh2w-9m7w-hjg2

Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00435 Published 2024-01-23 No fix listed CWE-79

TI-2024-15042 CVE-2024-22496 · GHSA-v435-pfj6-68r3

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00435 Published 2024-01-23 No fix listed CWE-79

TI-2024-15041 CVE-2024-22494 · GHSA-6r88-ph68-rhgv

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile…

MEDIUM 58

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00466 Published 2024-01-12 No fix listed CWE-79

TI-2024-15040 CVE-2024-22493 · GHSA-3j4x-9q9q-3277

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content…

MEDIUM 58

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00556 Published 2024-01-12 No fix listed CWE-79

TI-2024-15039 CVE-2024-22492 · GHSA-859h-4w58-78xw

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact…

MEDIUM 58

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00556 Published 2024-01-12 No fix listed CWE-79

TI-2023-27401 CVE-2023-50136 · GHSA-39hm-h746-p544

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00408 Published 2024-01-09 No fix listed CWE-79

TI-2023-27402 CVE-2023-50137 · GHSA-xv7p-jw46-8r85

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.

LOW 25

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0046 Published 2023-12-14 No fix listed CWE-79

TI-2023-27389 CVE-2023-50102 · GHSA-p3ph-6245-4wfc

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).

LOW 25

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00428 Published 2023-12-14 No fix listed CWE-79

TI-2023-27388 CVE-2023-50101 · GHSA-m3p6-43xj-pf9v

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.

LOW 25

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00439 Published 2023-12-14 No fix listed CWE-79

TI-2023-27387 CVE-2023-50100 · GHSA-3hf6-f8ch-5869

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.

LOW 25

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00444 Published 2023-12-14 No fix listed CWE-79

TI-2023-27595 CVE-2023-50449 · GHSA-7x2g-4jvc-4x6p

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal…

LOW 35

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01213 Published 2023-12-10 No fix listed CWE-22

TI-2023-27033 CVE-2023-49487 · GHSA-m42v-qv3c-h6j7

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in…

LOW 25

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00413 Published 2023-12-08 No fix listed CWE-79

TI-2023-27032 CVE-2023-49486 · GHSA-hjfp-2j7q-xmx4

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in…

LOW 25

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00417 Published 2023-12-08 No fix listed CWE-79

TI-2023-27031 CVE-2023-49485 · GHSA-f2w8-4m48-5qrq

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in…

LOW 27

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00413 Published 2023-12-08 No fix listed CWE-79

TI-2023-27018 CVE-2023-49448 · GHSA-pv3g-vc3q-8c9g

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.

LOW 38

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.