Skip to content
OpenAdvisories

Package · Maven

com.jfinal:jfinal

36 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

36 results · Feed

  • Medium 6.1
    CVE-2024-22497

    Cross-site Scripting in JFinal

    Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.

    com.jfinal:jfinal Maven
  • Medium 6.1
    CVE-2024-22496

    Cross-site Scripting in JFinal

    Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2024-22492

    Cross-site Scripting in JFinal

    A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2024-22493

    Cross-site Scripting in JFinal

    A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50137

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50100

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50102

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50101

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.

    com.jfinal:jfinal Maven
  • High 7.5
    CVE-2023-50449

    Directory Traversal in JFinalCMS

    JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-49487

    Cross-site Scripting in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-49485

    Cross-site Scripting in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-49486

    Cross-site Scripting in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49378

    Cross-Site Request Forgery in JFinalCMS via /admin/form/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49374

    Cross-Site Request Forgery in JFinalCMS via /admin/slide/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49382

    Cross-Site Request Forgery in JFinalCMS via /admin/div/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49397

    Cross-Site Request Forgery in JFinalCMS via /admin/category/updateStatus

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49372

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49396

    Cross-Site Request Forgery in JFinalCMS via /admin/category/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49447

    Cross-Site Request Forgery in JFinalCMS via /admin/nav/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49446

    Cross-Site Request Forgery in JFinalCMS via /admin/nav/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49380

    Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49398

    Cross-Site Request Forgery in JFinalCMS via /admin/category/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49448

    Cross-Site Request Forgery in JFinalCMS via admin/nav/delete

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49383

    Cross-Site Request Forgery in JFinalCMS via /admin/tag/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49379

    Cross-Site Request Forgery in JFinalCMS via the component /admin/friend_link/save

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49375

    Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49395

    Cross-Site Request Forgery in JFinalCMS via /admin/category/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49381

    Cross-Site Request Forgery in JFinalCMS via /admin/div/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49376

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49377

    Cross-Site Request Forgery in JFinalCMS via /admin/tag/update

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.

    com.jfinal:jfinal Maven
  • High 8.8
    CVE-2023-49373

    Cross-Site Request Forgery in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.

    com.jfinal:jfinal Maven
  • Critical 9.8
    CVE-2021-31635

    jFinal Server-Side Template Injection vulnerability

    Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2022-33113

    Cross-site Scripting in Jfinal CMS

    Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.

    com.jfinal:jfinal Maven
  • Critical —
    CVE-2021-31649

    JFinal Java Deserialization Vulnerability

    In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute

    com.jfinal:jfinal Maven
  • Medium 6.1
    CVE-2021-33348

    Cross-site scripting in jfinal

    An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.

    com.jfinal:jfinal Maven
  • High 7.5
    CVE-2019-17352

    JFinal file validation vulnerability

    In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not…

    com.jfinal:jfinal Maven