Overview 117 matches · 42 in Waratek scope · 5 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
117matches
42in Waratek scope35.9%
5protected4.3%
1exploited0.9%
0CISA KEV0.0%
1public PoC0.9%
0EPSS ≥ 0.50.0%
Protected by Waratek
5
4.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
37
31.6%
Outside Waratek scope
0
0.0%
Not applicable
74
63.2%
Withdrawn CVE
1
0.9%
blocked by ARMR today
5
4.3%
partly blocked
0
0.0%
not blocked
112
95.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
0.9%
Working exploit published
0
0.0%
Proof of concept only
36
30.8%
Forecast only
0
0.0%
No public exploit
80
68.4%
split by
peak 37 / year
20191
No exploit published1
High1
not blocked1
No public exploit1
20200
202111
Protected by Waratek1
No exploit published1
Not applicable9
Critical1
High5
Medium5
blocked by ARMR today1
not blocked10
No public exploit11
202237
Protected by Waratek3
No exploit published3
Not applicable31
Critical7
High24
Medium6
blocked by ARMR today3
not blocked34
Proof of concept only4
No public exploit33
202336
Protected by Waratek1
No exploit published28
Not applicable6
Withdrawn CVE1
Critical4
High21
Medium10
Unknown1
blocked by ARMR today1
not blocked35
Exploited1
Proof of concept only2
No public exploit33
202420
No exploit published4
Not applicable16
Critical2
High3
Medium15
not blocked20
Proof of concept only18
No public exploit2
202511
Not applicable11
Critical2
High3
Medium5
Low1
not blocked11
Proof of concept only11
20261
Not applicable1
Low1
not blocked1
Proof of concept only1
20192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-2200 | Low | 2026-02-09 | Not applicable | Proof of concept only | A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. |
| CVE-2025-6105 | Low | 2025-06-16 | Not applicable | Proof of concept only | A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-57665 | Critical | 2025-01-29 | Not applicable | Proof of concept only | JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering. |
| CVE-2024-57776 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57775 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid. |
| CVE-2024-57774 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the getBusinessUploadListPage?busid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57773 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57772 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57771 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57770 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. |
| CVE-2024-57769 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. |
| CVE-2024-57768 | Critical | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key. |
| CVE-2024-12351 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. |
| CVE-2024-12350 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the argument content leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-12349 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tag/save. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-53477 | Critical | 2024-12-02 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
| CVE-2024-8782 | Medium | 2024-09-13 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-8706 | Medium | 2024-09-12 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-8694 | Medium | 2024-09-11 | Not applicable | Proof of concept only | A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-40322 | High | 2024-07-16 | Not applicable | Proof of concept only | An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data |
| CVE-2024-5379 | Medium | 2024-05-26 | Not applicable | No public exploit | A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266291. |
| CVE-2024-5310 | Medium | 2024-05-24 | Not applicable | Proof of concept only | A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266121 was assigned to this vulnerability. |
| CVE-2023-51254 | Medium | 2024-04-29 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component. |
| CVE-2024-2568 | High | 2024-03-17 | Not applicable | Proof of concept only | A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071. |
| CVE-2024-24375 | High | 2024-03-07 | Not applicable | Proof of concept only | SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. |
| CVE-2024-24029 | Critical | 2024-02-02 | Not applicable | Proof of concept only | JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data. |
| CVE-2024-22497 | Medium | 2024-01-23 | No exploit published | Proof of concept only | Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. |
| CVE-2024-22496 | Medium | 2024-01-23 | No exploit published | Proof of concept only | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. |
| CVE-2024-22494 | Medium | 2024-01-12 | Not applicable | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2024-22493 | Medium | 2024-01-12 | No exploit published | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2024-22492 | Medium | 2024-01-12 | No exploit published | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2023-50136 | Medium | 2024-01-09 | Not applicable | Proof of concept only | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. |
| CVE-2023-50137 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. |
| CVE-2023-50102 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). |
| CVE-2023-50101 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. |
| CVE-2023-50100 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. |
| CVE-2023-50449 | High | 2023-12-10 | Protected by Waratek | No public exploit | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. |
| CVE-2023-49487 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. |
| CVE-2023-49486 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. |
| CVE-2023-49485 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. |
| CVE-2023-49448 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete. |
| CVE-2023-49447 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update. |
| CVE-2023-49446 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save. |
| CVE-2023-49398 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete. |
| CVE-2023-49397 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus. |
| CVE-2023-49396 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save. |
| CVE-2023-49395 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update. |
| CVE-2023-49383 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. |
| CVE-2023-49382 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete. |
| CVE-2023-49381 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update. |
| CVE-2023-49380 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete. |
| CVE-2023-49379 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save. |
| CVE-2023-49378 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save. |
| CVE-2023-49377 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update. |
| CVE-2023-49376 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete. |
| CVE-2023-49375 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update. |
| CVE-2023-49374 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update. |
| CVE-2023-49373 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete. |
| CVE-2023-49372 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save. |
| CVE-2023-47503 | Critical | 2023-11-28 | Not applicable | No public exploit | An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module. |
| CVE-2023-41599 | Medium | 2023-09-19 | Not applicable | Exploited | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. |
| CVE-2021-31635 | Critical | 2023-06-26 | No exploit published | No public exploit | Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function. |
| CVE-2023-34645 | High | 2023-06-16 | Not applicable | Proof of concept only | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
| CVE-2023-26812 | Unknown | 2023-04-28 | Withdrawn CVE | No public exploit | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-26813. Reason: This record is a reservation duplicate of CVE-2023-26813. Notes: All CVE users should reference CVE-2023-26813 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage. |
| CVE-2023-30349 | Critical | 2023-04-27 | No exploit published | Proof of concept only | JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function. |
| CVE-2023-24747 | Medium | 2023-04-05 | Not applicable | No public exploit | Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. |
| CVE-2023-0758 | Critical | 2023-02-09 | Not applicable | No public exploit | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability. |
| CVE-2023-22975 | Medium | 2023-02-03 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html. |
| CVE-2022-37202 | High | 2022-10-26 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list |
| CVE-2022-37208 | High | 2022-10-13 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37209 | High | 2022-09-27 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37205 | High | 2022-09-20 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37204 | Critical | 2022-09-20 | Not applicable | Proof of concept only | Final CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-37203 | Critical | 2022-09-19 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37207 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection |
| CVE-2022-37201 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-38286 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. |
| CVE-2022-38285 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. |
| CVE-2022-38284 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. |
| CVE-2022-38283 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. |
| CVE-2022-38282 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. |
| CVE-2022-38281 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. |
| CVE-2022-38280 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. |
| CVE-2022-38279 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. |
| CVE-2022-38278 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. |
| CVE-2022-38277 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. |
| CVE-2022-38276 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. |
| CVE-2022-38275 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. |
| CVE-2022-38274 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. |
| CVE-2022-38273 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. |
| CVE-2022-38272 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. |
| CVE-2022-36527 | Medium | 2022-08-25 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module. |
| CVE-2022-37223 | Critical | 2022-08-23 | Protected by Waratek | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list. |
| CVE-2022-37199 | Critical | 2022-08-23 | Protected by Waratek | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list. |
| CVE-2022-34928 | High | 2022-08-03 | Not applicable | No public exploit | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
| CVE-2022-33114 | High | 2022-06-23 | Not applicable | No public exploit | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. |
| CVE-2022-33113 | Medium | 2022-06-23 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module. |
| CVE-2022-29648 | Medium | 2022-06-02 | No exploit published | No public exploit | A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request. |
| CVE-2022-30500 | Critical | 2022-05-26 | Protected by Waratek | No public exploit | Jfinal cms 5.1.0 is vulnerable to SQL Injection. |
| CVE-2021-42242 | Critical | 2022-05-05 | Not applicable | No public exploit | A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor. |