Overview 44 matches · 6 in Waratek scope · 3 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
44matches
6in Waratek scope13.6%
3protected6.8%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
3
6.8%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
6.8%
Outside Waratek scope
0
0.0%
Not applicable
38
86.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
6.8%
partly blocked
0
0.0%
not blocked
41
93.2%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
44
100.0%
split by
peak 23 / quarter
Q3 218
Not applicable8
High4
Medium4
not blocked8
No public exploit8
Q4 211
Not applicable1
High1
not blocked1
No public exploit1
Q1 221
Not applicable1
Medium1
not blocked1
No public exploit1
Q2 227
Protected by Waratek1
No exploit published2
Not applicable4
Critical2
High2
Medium3
blocked by ARMR today1
not blocked6
No public exploit7
Q3 2223
Protected by Waratek2
No exploit published1
Not applicable20
Critical3
High19
Medium1
blocked by ARMR today2
not blocked21
No public exploit23
Q4 220
Q1 231
Not applicable1
Medium1
not blocked1
No public exploit1
Q2 231
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 230
Q4 231
Not applicable1
Critical1
not blocked1
No public exploit1
Q1 240
Q2 240
Q3 240
Q4 241
Not applicable1
Critical1
not blocked1
No public exploit1
Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-53477 | Critical | 2024-12-02 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
| CVE-2023-47503 | Critical | 2023-11-28 | Not applicable | No public exploit | An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module. |
| CVE-2023-24747 | Medium | 2023-04-05 | Not applicable | No public exploit | Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. |
| CVE-2023-22975 | Medium | 2023-02-03 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html. |
| CVE-2022-37209 | High | 2022-09-27 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37203 | Critical | 2022-09-19 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37207 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection |
| CVE-2022-37201 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-38286 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. |
| CVE-2022-38285 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. |
| CVE-2022-38284 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. |
| CVE-2022-38283 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. |
| CVE-2022-38282 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. |
| CVE-2022-38281 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. |
| CVE-2022-38280 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. |
| CVE-2022-38279 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. |
| CVE-2022-38278 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. |
| CVE-2022-38277 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. |
| CVE-2022-38276 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. |
| CVE-2022-38275 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. |
| CVE-2022-38274 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. |
| CVE-2022-38273 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. |
| CVE-2022-38272 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. |
| CVE-2022-36527 | Medium | 2022-08-25 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module. |
| CVE-2022-37223 | Critical | 2022-08-23 | Protected by Waratek | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list. |
| CVE-2022-37199 | Critical | 2022-08-23 | Protected by Waratek | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list. |
| CVE-2022-34928 | High | 2022-08-03 | Not applicable | No public exploit | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
| CVE-2022-33114 | High | 2022-06-23 | Not applicable | No public exploit | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. |
| CVE-2022-33113 | Medium | 2022-06-23 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module. |
| CVE-2022-29648 | Medium | 2022-06-02 | No exploit published | No public exploit | A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request. |
| CVE-2022-30500 | Critical | 2022-05-26 | Protected by Waratek | No public exploit | Jfinal cms 5.1.0 is vulnerable to SQL Injection. |
| CVE-2021-42242 | Critical | 2022-05-05 | Not applicable | No public exploit | A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor. |
| CVE-2022-28505 | High | 2022-05-03 | Not applicable | No public exploit | Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java. |
| CVE-2022-27111 | Medium | 2022-04-11 | Not applicable | No public exploit | Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it. |
| CVE-2021-46087 | Medium | 2022-01-25 | Not applicable | No public exploit | In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code. |
| CVE-2021-37262 | High | 2021-12-16 | Not applicable | No public exploit | JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. |
| CVE-2021-40639 | High | 2021-09-15 | Not applicable | No public exploit | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. |
| CVE-2020-19155 | High | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19154 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19151 | High | 2021-09-15 | Not applicable | No public exploit | Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'. |
| CVE-2020-19150 | High | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19148 | Medium | 2021-09-15 | Not applicable | No public exploit | Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/jfinal_cms/front/person/profile.html'. |
| CVE-2020-19147 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'. |
| CVE-2020-19146 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'. |