Vendorsjfinalcms Projectjfinalcmsall versions
Vulnerabilities

jfinalcms Project jfinalcms

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

39CVEs
CVE-2022-27341
JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.
Published 2022-04-22 · Modified
9.8EPSS 0.012
CVE-2024-24029
JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.
Published 2024-02-02 · Modified
9.8EPSS 0.008
CVE-2024-40322
An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data
Published 2024-07-16 · Modified
8.8EPSS 0.004
CVE-2023-49379
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49447
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49448
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49446
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49398
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49397
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49396
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49395
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49383
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49381
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49372
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49373
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49374
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49375
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49377
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49382
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49380
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49376
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-49378
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.
Published 2023-12-05 · Modified
8.8EPSS 0.004
CVE-2023-50449
JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.
Published 2023-12-10 · Modified
7.5EPSS 0.012
CVE-2024-24375
SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.
Published 2024-03-07 · Analyzed
7.5EPSS 0.005
CVE-2023-51254
Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component.
Published 2024-04-29 · Analyzed
6.1EPSS 0.006
CVE-2024-22496
Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.
Published 2024-01-23 · Modified
6.1EPSS 0.004
CVE-2024-22497
Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
Published 2024-01-23 · Modified
6.1EPSS 0.004
CVE-2024-22492
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.
Published 2024-01-12 · Modified
5.4EPSS 0.006
CVE-2024-22493
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.
Published 2024-01-12 · Modified
5.4EPSS 0.006
CVE-2024-22494
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML.
Published 2024-01-12 · Modified
5.4EPSS 0.005
CVE-2023-50137
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
Published 2023-12-14 · Modified
5.4EPSS 0.005
CVE-2023-50100
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
Published 2023-12-14 · Modified
5.4EPSS 0.004
CVE-2023-50101
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
Published 2023-12-14 · Modified
5.4EPSS 0.004
CVE-2023-50102
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
Published 2023-12-14 · Modified
5.4EPSS 0.004
CVE-2023-49486
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
Published 2023-12-08 · Modified
5.4EPSS 0.004
CVE-2023-49487
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.
Published 2023-12-08 · Modified
5.4EPSS 0.004
CVE-2023-49485
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
Published 2023-12-08 · Modified
5.4EPSS 0.004
CVE-2023-50136
Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.
Published 2024-01-09 · Modified
5.4EPSS 0.004
CVE-2023-41599
An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.
Published 2023-09-19 · Modified
5.3EPSS 0.124