Jfinalcms Project

39 CVEs across 1 Jfinalcms Project products. Browse Jfinalcms Project vulnerabilities, severities, and proof-of-concept exploits.

Jfinalcms Project products with known CVEs

Product	CVEs
Jfinalcms	39

Jfinalcms Project CVEs — newest first
CVE	Severity	Score	Published	Summary
`CVE-2024-40322`	High	`8.8`	2024-07-16	An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data
`CVE-2023-51254`	Medium	`6.1`	2024-04-29	Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link componen…
`CVE-2024-24375`	High	`7.5`	2024-03-07	SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.
`CVE-2024-24029`	Critical	`9.8`	2024-02-02	JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.
`CVE-2024-22497`	Medium	`6.1`	2024-01-23	Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
`CVE-2024-22496`	Medium	`6.1`	2024-01-23	Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.
`CVE-2024-22494`	Medium	`5.4`	2024-01-12	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or…
`CVE-2024-22493`	Medium	`5.4`	2024-01-12	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or…
`CVE-2024-22492`	Medium	`5.4`	2024-01-12	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or…
`CVE-2023-50136`	Medium	`5.4`	2024-01-09	Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.
`CVE-2023-50137`	Medium	`5.4`	2023-12-14	JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
`CVE-2023-50102`	Medium	`5.4`	2023-12-14	JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
`CVE-2023-50101`	Medium	`5.4`	2023-12-14	JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
`CVE-2023-50100`	Medium	`5.4`	2023-12-14	JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
`CVE-2023-50449`	High	`7.5`	2023-12-10	JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.
`CVE-2023-49487`	Medium	`5.4`	2023-12-08	JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.
`CVE-2023-49486`	Medium	`5.4`	2023-12-08	JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
`CVE-2023-49485`	Medium	`5.4`	2023-12-08	JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
`CVE-2023-49448`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.
`CVE-2023-49447`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.
`CVE-2023-49446`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
`CVE-2023-49398`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.
`CVE-2023-49397`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
`CVE-2023-49396`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.
`CVE-2023-49395`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.
`CVE-2023-49383`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.
`CVE-2023-49382`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.
`CVE-2023-49381`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.
`CVE-2023-49380`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.
`CVE-2023-49379`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.
`CVE-2023-49378`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.
`CVE-2023-49377`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.
`CVE-2023-49376`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.
`CVE-2023-49375`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.
`CVE-2023-49374`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
`CVE-2023-49373`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.
`CVE-2023-49372`	High	`8.8`	2023-12-05	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
`CVE-2023-41599`	Medium	`5.3`	2023-09-19	An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.
`CVE-2022-27341`	Critical	`9.8`	2022-04-22	JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.