Medium · 6.1 CVE-2024-22496 EUVD-2024-0430GHSA-v435-pfj6-68r3

Cross-site Scripting in JFinal

Published Jan 23, 2024 · Updated Jun 5, 2025 · Assigned by mitre

Description

Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.

Ecosystem	Package	Affected	Fixed	Record
Maven	com.jfinal:jfinal	<= 5.0.0	—	GHSA-v435-pfj6-68r3