Jfinal CMS
by Jflyfox
Source repositories
CVEs (52)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-37262 | Hig | 0.49 | 7.5 | 0.01 | Dec 16, 2021 | JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. | ||
| CVE-2021-40639 | Hig | 0.49 | 7.5 | 0.01 | Sep 15, 2021 | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. | ||
| CVE-2022-38286 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. | ||
| CVE-2022-38285 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. | ||
| CVE-2022-38284 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. | ||
| CVE-2022-38283 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. | ||
| CVE-2022-38282 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. | ||
| CVE-2022-38281 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. | ||
| CVE-2022-38280 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. | ||
| CVE-2022-38279 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. | ||
| CVE-2022-38278 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. | ||
| CVE-2022-38277 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. | ||
| CVE-2022-38276 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. | ||
| CVE-2022-38275 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. | ||
| CVE-2022-38274 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. | ||
| CVE-2022-38273 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. | ||
| CVE-2022-38272 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. | ||
| CVE-2022-33114 | Hig | 0.47 | 7.2 | 0.01 | Jun 23, 2022 | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. | ||
| CVE-2022-28505 | Hig | 0.47 | 7.2 | 0.01 | May 3, 2022 | Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java. | ||
| CVE-2020-19154 | Med | 0.43 | 6.5 | 0.04 | Sep 15, 2021 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'. |
- risk 0.49cvss 7.5epss 0.01
JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.
- risk 0.49cvss 7.5epss 0.01
Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.
- risk 0.47cvss 7.2epss 0.01
Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list.
- risk 0.47cvss 7.2epss 0.01
Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java.
- risk 0.43cvss 6.5epss 0.04
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'.
Page 2 of 3