Jfinalcms
CVEs (38)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-49372 | Hig | 0.57 | 8.8 | 0.00 | Dec 5, 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save. | ||
| CVE-2024-24375 | Hig | 0.49 | 7.5 | 0.00 | Mar 7, 2024 | SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. | ||
| CVE-2023-50449 | Hig | 0.49 | 7.5 | 0.01 | Dec 10, 2023 | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. | ||
| CVE-2023-51254 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2024 | Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component. | ||
| CVE-2024-22497 | Med | 0.40 | 6.1 | 0.00 | Jan 23, 2024 | Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. | ||
| CVE-2024-22496 | Med | 0.40 | 6.1 | 0.00 | Jan 23, 2024 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. | ||
| CVE-2024-22494 | Med | 0.35 | 5.4 | 0.00 | Jan 12, 2024 | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2024-22493 | Med | 0.35 | 5.4 | 0.01 | Jan 12, 2024 | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2024-22492 | Med | 0.35 | 5.4 | 0.01 | Jan 12, 2024 | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2023-50136 | Med | 0.35 | 5.4 | 0.00 | Jan 9, 2024 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. | ||
| CVE-2023-50137 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. | ||
| CVE-2023-50102 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2023-50101 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. | ||
| CVE-2023-50100 | Med | 0.35 | 5.4 | 0.00 | Dec 14, 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. | ||
| CVE-2023-49487 | Med | 0.35 | 5.4 | 0.00 | Dec 8, 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. | ||
| CVE-2023-49486 | Med | 0.35 | 5.4 | 0.00 | Dec 8, 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. | ||
| CVE-2023-49485 | Med | 0.35 | 5.4 | 0.00 | Dec 8, 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. | ||
| CVE-2023-41599 | Med | 0.35 | 5.3 | 0.11 | Sep 19, 2023 | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. |
- risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
- risk 0.49cvss 7.5epss 0.00
SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.
- risk 0.49cvss 7.5epss 0.01
JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.
- risk 0.35cvss 5.4epss 0.00
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML.
- risk 0.35cvss 5.4epss 0.01
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.
- risk 0.35cvss 5.4epss 0.01
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.
- risk 0.35cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.
- risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
- risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
- risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
- risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
- risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.
- risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
- risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
- risk 0.35cvss 5.3epss 0.11
An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.
Page 2 of 2