Vendor CVEs

Jfinalcms Project

All CVEs

38 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-24029	Jfinalcms Project Jfinalcms	Cri	0.64	9.8	0.01	Feb 2, 2024	JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.
CVE-2022-27341	JFinalcms JFinalcms	Cri	0.64	9.8	0.01	Apr 22, 2022	JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.
CVE-2023-49448	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.
CVE-2023-49447	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.
CVE-2023-49446	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
CVE-2023-49398	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.
CVE-2023-49397	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
CVE-2023-49396	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.
CVE-2023-49395	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.
CVE-2023-49383	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.
CVE-2023-49382	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.
CVE-2023-49381	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.
CVE-2023-49380	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.
CVE-2023-49379	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.
CVE-2023-49378	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.
CVE-2023-49377	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.
CVE-2023-49376	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.
CVE-2023-49375	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.
CVE-2023-49374	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
CVE-2023-49373	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.
CVE-2023-49372	Jfinalcms Project Jfinalcms	Hig	0.57	8.8	0.00	Dec 5, 2023	JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
CVE-2024-24375	JFinalcms JFinalcms	Hig	0.49	7.5	0.00	Mar 7, 2024	SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.
CVE-2023-50449	Jfinalcms Project Jfinalcms	Hig	0.49	7.5	0.01	Dec 10, 2023	JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.
CVE-2023-51254	JFinalcms JFinalcms	Med	0.40	6.1	0.01	Apr 29, 2024	Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component.
CVE-2024-22497	Jfinalcms Project Jfinalcms	Med	0.40	6.1	0.00	Jan 23, 2024	Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
CVE-2024-22496	Jfinalcms Project Jfinalcms	Med	0.40	6.1	0.00	Jan 23, 2024	Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.
CVE-2024-22494	JFinalcms JFinalcms	Med	0.35	5.4	0.00	Jan 12, 2024	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML.
CVE-2024-22493	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.01	Jan 12, 2024	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.
CVE-2024-22492	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.01	Jan 12, 2024	A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.
CVE-2023-50136	JFinalcms JFinalcms	Med	0.35	5.4	0.00	Jan 9, 2024	Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.
CVE-2023-50137	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.00	Dec 14, 2023	JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
CVE-2023-50102	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.00	Dec 14, 2023	JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-50101	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.00	Dec 14, 2023	JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
CVE-2023-50100	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.00	Dec 14, 2023	JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
CVE-2023-49487	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.00	Dec 8, 2023	JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.
CVE-2023-49486	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.00	Dec 8, 2023	JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
CVE-2023-49485	Jfinalcms Project Jfinalcms	Med	0.35	5.4	0.00	Dec 8, 2023	JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
CVE-2023-41599	JFinalcms JFinalcms	Med	0.35	5.3	0.11	Sep 19, 2023	An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.

CVE-2024-24029CriFeb 2, 2024
Jfinalcms Project
Jfinalcms
risk 0.64cvss 9.8epss 0.01
JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.
CVE-2022-27341CriApr 22, 2022
JFinalcms
JFinalcms
risk 0.64cvss 9.8epss 0.01
JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.
CVE-2023-49448HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.
CVE-2023-49447HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.
CVE-2023-49446HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
CVE-2023-49398HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.
CVE-2023-49397HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
CVE-2023-49396HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.
CVE-2023-49395HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.
CVE-2023-49383HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.
CVE-2023-49382HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.
CVE-2023-49381HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.
CVE-2023-49380HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.
CVE-2023-49379HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.
CVE-2023-49378HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.
CVE-2023-49377HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.
CVE-2023-49376HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.
CVE-2023-49375HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.
CVE-2023-49374HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
CVE-2023-49373HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.
CVE-2023-49372HigDec 5, 2023
Jfinalcms Project
Jfinalcms
risk 0.57cvss 8.8epss 0.00
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
CVE-2024-24375HigMar 7, 2024
JFinalcms
JFinalcms
risk 0.49cvss 7.5epss 0.00
SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.
CVE-2023-50449HigDec 10, 2023
Jfinalcms Project
Jfinalcms
risk 0.49cvss 7.5epss 0.01
JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.
CVE-2023-51254MedApr 29, 2024
JFinalcms
JFinalcms
risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component.
CVE-2024-22497MedJan 23, 2024
Jfinalcms Project
Jfinalcms
risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
CVE-2024-22496MedJan 23, 2024
Jfinalcms Project
Jfinalcms
risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.
CVE-2024-22494MedJan 12, 2024
JFinalcms
JFinalcms
risk 0.35cvss 5.4epss 0.00
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML.
CVE-2024-22493MedJan 12, 2024
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.01
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.
CVE-2024-22492MedJan 12, 2024
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.01
A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.
CVE-2023-50136MedJan 9, 2024
JFinalcms
JFinalcms
risk 0.35cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table.
CVE-2023-50137MedDec 14, 2023
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
CVE-2023-50102MedDec 14, 2023
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-50101MedDec 14, 2023
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
CVE-2023-50100MedDec 14, 2023
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.00
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
CVE-2023-49487MedDec 8, 2023
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.
CVE-2023-49486MedDec 8, 2023
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
CVE-2023-49485MedDec 8, 2023
Jfinalcms Project
Jfinalcms
risk 0.35cvss 5.4epss 0.00
JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
CVE-2023-41599MedSep 19, 2023
JFinalcms
JFinalcms
risk 0.35cvss 5.3epss 0.11
An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.