Skip to content
OpenAdvisories

Package · Maven

com.jfinal:jfinal

36 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.1
    CVE-2024-22497

    Cross-site Scripting in JFinal

    Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.

    com.jfinal:jfinal Maven
  • Medium 6.1
    CVE-2024-22496

    Cross-site Scripting in JFinal

    Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2024-22492

    Cross-site Scripting in JFinal

    A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2024-22493

    Cross-site Scripting in JFinal

    A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50137

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50100

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50102

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50101

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-49487

    Cross-site Scripting in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-49485

    Cross-site Scripting in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-49486

    Cross-site Scripting in JFinalCMS

    JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2022-33113

    Cross-site Scripting in Jfinal CMS

    Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.

    com.jfinal:jfinal Maven
  • Medium 6.1
    CVE-2021-33348

    Cross-site scripting in jfinal

    An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.

    com.jfinal:jfinal Maven