WaratekVRT Sign in

Medium Jfinal CVEs with no public exploit

11 CVEs

Reset
More filters (1)
Columns
Product jfinal✕
Overview 11 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
11matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 11 100.0%
Critical 0 0.0% High 0 0.0% Medium 11 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 100.0%
split by peak 7 / quarter
No exploit published: 11 Medium: 11 not blocked: 11 No public exploit: 11
Q2 211 No exploit published1 Medium1 not blocked1 No public exploit1 Q3 210 Q4 210 Q1 220 Q2 222 No exploit published2 Medium2 not blocked2 No public exploit2 Q3 221 No exploit published1 Medium1 not blocked1 No public exploit1 Q4 220 Q1 230 Q2 230 Q3 230 Q4 237 No exploit published7 Medium7 not blocked7 No public exploit7
Q2 21Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22Q1 23Q2 23Q3 23Q4 23
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-50137 Medium 2023-12-14 No exploit published No public exploit JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
CVE-2023-50102 Medium 2023-12-14 No exploit published No public exploit JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-50101 Medium 2023-12-14 No exploit published No public exploit JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
CVE-2023-50100 Medium 2023-12-14 No exploit published No public exploit JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
CVE-2023-49487 Medium 2023-12-08 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.
CVE-2023-49486 Medium 2023-12-08 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
CVE-2023-49485 Medium 2023-12-08 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
CVE-2022-36527 Medium 2022-08-25 No exploit published No public exploit Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module.
CVE-2022-33113 Medium 2022-06-23 No exploit published No public exploit Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
CVE-2022-29648 Medium 2022-06-02 No exploit published No public exploit A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request.
CVE-2021-33348 Medium 2021-06-24 No exploit published No public exploit An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.