Jflyfox Jfinal_cms
52 CVEs affecting Jflyfox Jfinal_cms. Latest disclosed: 2026-06-08. Critical: 9, High: 30.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53477 | Critical | 9.8 | 2024-12-02 | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
CVE-2023-47503 | Critical | 9.8 | 2023-11-28 | An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template manage… |
CVE-2023-30349 | Critical | 9.8 | 2023-04-27 | JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function. |
CVE-2022-37204 | Critical | 9.8 | 2022-09-20 | Final CMS 5.1.0 is vulnerable to SQL Injection. |
CVE-2022-37203 | Critical | 9.8 | 2022-09-19 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenat… |
CVE-2022-37223 | Critical | 9.8 | 2022-08-23 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list. |
CVE-2022-37199 | Critical | 9.8 | 2022-08-23 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list. |
CVE-2022-30500 | Critical | 9.8 | 2022-05-26 | Jfinal cms 5.1.0 is vulnerable to SQL Injection. |
CVE-2021-42242 | Critical | 9.8 | 2022-05-05 | A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor. |
CVE-2022-37202 | High | 8.8 | 2022-10-26 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list |
CVE-2022-37208 | High | 8.8 | 2022-10-13 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenat… |
CVE-2022-37209 | High | 8.8 | 2022-09-27 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-37205 | High | 8.8 | 2022-09-20 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-37201 | High | 8.8 | 2022-09-15 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
CVE-2022-37207 | High | 8.8 | 2022-09-15 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-34928 | High | 8.8 | 2022-08-03 | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
CVE-2020-19155 | High | 8.8 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileMan… |
CVE-2020-19151 | High | 8.8 | 2021-09-15 | Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the compon… |
CVE-2020-19150 | High | 8.1 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileMana… |
CVE-2023-34645 | High | 7.5 | 2023-06-16 | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |