Overview 80 matches · 37 in Waratek scope · 5 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
80matches
37in Waratek scope46.2%
5protected6.2%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
5
6.2%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
32
40.0%
Outside Waratek scope
0
0.0%
Not applicable
42
52.5%
Withdrawn CVE
1
1.2%
blocked by ARMR today
5
6.2%
partly blocked
0
0.0%
not blocked
75
93.8%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
80
100.0%
split by
peak 28 / quarter
Q4 191
No exploit published1
High1
not blocked1
No public exploit1
Q1 200
Q2 200
Q3 200
Q4 200
Q1 210
Q2 212
Protected by Waratek1
No exploit published1
Critical1
Medium1
blocked by ARMR today1
not blocked1
No public exploit2
Q3 218
Not applicable8
High4
Medium4
not blocked8
No public exploit8
Q4 211
Not applicable1
High1
not blocked1
No public exploit1
Q1 222
Not applicable2
Medium2
not blocked2
No public exploit2
Q2 228
Protected by Waratek1
No exploit published2
Not applicable5
Critical3
High2
Medium3
blocked by ARMR today1
not blocked7
No public exploit8
Q3 2223
Protected by Waratek2
No exploit published1
Not applicable20
Critical3
High19
Medium1
blocked by ARMR today2
not blocked21
No public exploit23
Q4 220
Q1 232
Not applicable2
Critical1
Medium1
not blocked2
No public exploit2
Q2 233
No exploit published1
Not applicable1
Withdrawn CVE1
Critical1
Medium1
Unknown1
not blocked3
No public exploit3
Q3 230
Q4 2328
Protected by Waratek1
No exploit published26
Not applicable1
Critical1
High20
Medium7
blocked by ARMR today1
not blocked27
No public exploit28
Q1 240
Q2 241
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 240
Q4 241
Not applicable1
Critical1
not blocked1
No public exploit1
Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-53477 | Critical | 2024-12-02 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
| CVE-2024-5379 | Medium | 2024-05-26 | Not applicable | No public exploit | A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266291. |
| CVE-2023-50137 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. |
| CVE-2023-50102 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). |
| CVE-2023-50101 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. |
| CVE-2023-50100 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. |
| CVE-2023-50449 | High | 2023-12-10 | Protected by Waratek | No public exploit | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. |
| CVE-2023-49487 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. |
| CVE-2023-49486 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. |
| CVE-2023-49485 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. |
| CVE-2023-49448 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete. |
| CVE-2023-49447 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update. |
| CVE-2023-49446 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save. |
| CVE-2023-49398 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete. |
| CVE-2023-49397 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus. |
| CVE-2023-49396 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save. |
| CVE-2023-49395 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update. |
| CVE-2023-49383 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. |
| CVE-2023-49382 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete. |
| CVE-2023-49381 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update. |
| CVE-2023-49380 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete. |
| CVE-2023-49379 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save. |
| CVE-2023-49378 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save. |
| CVE-2023-49377 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update. |
| CVE-2023-49376 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete. |
| CVE-2023-49375 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update. |
| CVE-2023-49374 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update. |
| CVE-2023-49373 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete. |
| CVE-2023-49372 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save. |
| CVE-2023-47503 | Critical | 2023-11-28 | Not applicable | No public exploit | An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module. |
| CVE-2021-31635 | Critical | 2023-06-26 | No exploit published | No public exploit | Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function. |
| CVE-2023-26812 | Unknown | 2023-04-28 | Withdrawn CVE | No public exploit | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-26813. Reason: This record is a reservation duplicate of CVE-2023-26813. Notes: All CVE users should reference CVE-2023-26813 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage. |
| CVE-2023-24747 | Medium | 2023-04-05 | Not applicable | No public exploit | Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. |
| CVE-2023-0758 | Critical | 2023-02-09 | Not applicable | No public exploit | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability. |
| CVE-2023-22975 | Medium | 2023-02-03 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html. |
| CVE-2022-37209 | High | 2022-09-27 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37203 | Critical | 2022-09-19 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37207 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection |
| CVE-2022-37201 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-38286 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. |
| CVE-2022-38285 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. |
| CVE-2022-38284 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. |
| CVE-2022-38283 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. |
| CVE-2022-38282 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. |
| CVE-2022-38281 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. |
| CVE-2022-38280 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. |
| CVE-2022-38279 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. |
| CVE-2022-38278 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. |
| CVE-2022-38277 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. |
| CVE-2022-38276 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. |
| CVE-2022-38275 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. |
| CVE-2022-38274 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. |
| CVE-2022-38273 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. |
| CVE-2022-38272 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. |
| CVE-2022-36527 | Medium | 2022-08-25 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module. |
| CVE-2022-37223 | Critical | 2022-08-23 | Protected by Waratek | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list. |
| CVE-2022-37199 | Critical | 2022-08-23 | Protected by Waratek | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list. |
| CVE-2022-34928 | High | 2022-08-03 | Not applicable | No public exploit | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
| CVE-2022-33114 | High | 2022-06-23 | Not applicable | No public exploit | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. |
| CVE-2022-33113 | Medium | 2022-06-23 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module. |
| CVE-2022-29648 | Medium | 2022-06-02 | No exploit published | No public exploit | A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request. |
| CVE-2022-30500 | Critical | 2022-05-26 | Protected by Waratek | No public exploit | Jfinal cms 5.1.0 is vulnerable to SQL Injection. |
| CVE-2021-42242 | Critical | 2022-05-05 | Not applicable | No public exploit | A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor. |
| CVE-2022-28505 | High | 2022-05-03 | Not applicable | No public exploit | Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java. |
| CVE-2022-27341 | Critical | 2022-04-22 | Not applicable | No public exploit | JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. |
| CVE-2022-27111 | Medium | 2022-04-11 | Not applicable | No public exploit | Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it. |
| CVE-2021-40645 | Medium | 2022-03-30 | Not applicable | No public exploit | An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController. |
| CVE-2021-46087 | Medium | 2022-01-25 | Not applicable | No public exploit | In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code. |
| CVE-2021-37262 | High | 2021-12-16 | Not applicable | No public exploit | JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. |
| CVE-2021-40639 | High | 2021-09-15 | Not applicable | No public exploit | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. |
| CVE-2020-19155 | High | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19154 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19151 | High | 2021-09-15 | Not applicable | No public exploit | Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'. |
| CVE-2020-19150 | High | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19148 | Medium | 2021-09-15 | Not applicable | No public exploit | Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/jfinal_cms/front/person/profile.html'. |
| CVE-2020-19147 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'. |
| CVE-2020-19146 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'. |
| CVE-2021-33348 | Medium | 2021-06-24 | No exploit published | No public exploit | An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases. |
| CVE-2021-31649 | Critical | 2021-06-24 | Protected by Waratek | No public exploit | In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute |
| CVE-2019-17352 | High | 2019-10-08 | No exploit published | No public exploit | In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions. |