CVE-2026-11473 | Medium | 6.3 | 2026-06-08 | A vulnerability was identified in jflyfox jfinal_cms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation o… |
CVE-2025-6105 | Medium | 4.3 | 2025-06-16 | A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The ma… |
CVE-2024-53477 | Critical | 9.8 | 2024-12-02 | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
CVE-2023-47503 | Critical | 9.8 | 2023-11-28 | An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template manage… |
CVE-2023-34645 | High | 7.5 | 2023-06-16 | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
CVE-2023-30349 | Critical | 9.8 | 2023-04-27 | JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function. |
CVE-2023-24747 | Medium | 5.4 | 2023-04-05 | Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. |
CVE-2023-22975 | Medium | 6.1 | 2023-02-03 | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into t… |
CVE-2022-37202 | High | 8.8 | 2022-10-26 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list |
CVE-2022-37208 | High | 8.8 | 2022-10-13 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenat… |
CVE-2022-37209 | High | 8.8 | 2022-09-27 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-37205 | High | 8.8 | 2022-09-20 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-37204 | Critical | 9.8 | 2022-09-20 | Final CMS 5.1.0 is vulnerable to SQL Injection. |
CVE-2022-37203 | Critical | 9.8 | 2022-09-19 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenat… |
CVE-2022-37201 | High | 8.8 | 2022-09-15 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
CVE-2022-37207 | High | 8.8 | 2022-09-15 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-38286 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. |
CVE-2022-38285 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. |
CVE-2022-38284 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. |
CVE-2022-38283 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. |
CVE-2022-38282 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. |
CVE-2022-38281 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. |
CVE-2022-38280 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. |
CVE-2022-38279 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. |
CVE-2022-38278 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. |
CVE-2022-38277 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. |
CVE-2022-38276 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. |
CVE-2022-38275 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. |
CVE-2022-38274 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. |
CVE-2022-38273 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. |
CVE-2022-38272 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. |
CVE-2022-36527 | Medium | 5.4 | 2022-08-25 | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blo… |
CVE-2022-37223 | Critical | 9.8 | 2022-08-23 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list. |
CVE-2022-37199 | Critical | 9.8 | 2022-08-23 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list. |
CVE-2022-34928 | High | 8.8 | 2022-08-03 | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
CVE-2022-33114 | High | 7.2 | 2022-06-23 | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. |
CVE-2022-33113 | Medium | 5.4 | 2022-06-23 | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog m… |
CVE-2022-29648 | Medium | 5.4 | 2022-06-02 | A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request. |
CVE-2022-30500 | Critical | 9.8 | 2022-05-26 | Jfinal cms 5.1.0 is vulnerable to SQL Injection. |
CVE-2021-42242 | Critical | 9.8 | 2022-05-05 | A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor. |
CVE-2022-28505 | High | 7.2 | 2022-05-03 | Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java. |
CVE-2022-27111 | Medium | 5.4 | 2022-04-11 | Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it. |
CVE-2021-46087 | Medium | 5.4 | 2022-01-25 | In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the… |
CVE-2021-37262 | High | 7.5 | 2021-12-16 | JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. |
CVE-2021-40639 | High | 7.5 | 2021-09-15 | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. |
CVE-2020-19155 | High | 8.8 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileMan… |
CVE-2020-19154 | Medium | 6.5 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in t… |
CVE-2020-19151 | High | 8.8 | 2021-09-15 | Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the compon… |
CVE-2020-19150 | High | 8.1 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileMana… |
CVE-2020-19148 | Medium | 5.4 | 2021-09-15 | Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/j… |
CVE-2020-19147 | Medium | 6.5 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the componen… |
CVE-2020-19146 | Medium | 6.5 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the compon… |