Overview 74 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
74matches
0in Waratek scope0.0%
0protected0.0%
1exploited1.4%
0CISA KEV0.0%
1public PoC1.4%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
74
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
74
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
1.4%
Working exploit published
0
0.0%
Proof of concept only
31
41.9%
Forecast only
0
0.0%
No public exploit
42
56.8%
split by
peak 22 / quarter
Q3 218
Not applicable8
High4
Medium4
not blocked8
No public exploit8
Q4 211
Not applicable1
High1
not blocked1
No public exploit1
Q1 222
Not applicable2
Medium2
not blocked2
No public exploit2
Q2 225
Not applicable5
Critical2
High2
Medium1
not blocked5
No public exploit5
Q3 2222
Not applicable22
Critical2
High20
not blocked22
Proof of concept only2
No public exploit20
Q4 222
Not applicable2
High2
not blocked2
Proof of concept only2
Q1 232
Not applicable2
Critical1
Medium1
not blocked2
No public exploit2
Q2 232
Not applicable2
High1
Medium1
not blocked2
Proof of concept only1
No public exploit1
Q3 231
Not applicable1
Medium1
not blocked1
Exploited1
Q4 231
Not applicable1
Critical1
not blocked1
No public exploit1
Q1 245
Not applicable5
Critical1
High2
Medium2
not blocked5
Proof of concept only5
Q2 243
Not applicable3
Medium3
not blocked3
Proof of concept only2
No public exploit1
Q3 244
Not applicable4
High1
Medium3
not blocked4
Proof of concept only4
Q4 244
Not applicable4
Critical1
Medium3
not blocked4
Proof of concept only3
No public exploit1
Q1 2510
Not applicable10
Critical2
High3
Medium5
not blocked10
Proof of concept only10
Q2 251
Not applicable1
Low1
not blocked1
Proof of concept only1
Q3 250
Q4 250
Q1 261
Not applicable1
Low1
not blocked1
Proof of concept only1
Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-2200 | Low | 2026-02-09 | Not applicable | Proof of concept only | A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. |
| CVE-2025-6105 | Low | 2025-06-16 | Not applicable | Proof of concept only | A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-57665 | Critical | 2025-01-29 | Not applicable | Proof of concept only | JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering. |
| CVE-2024-57776 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57775 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid. |
| CVE-2024-57774 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the getBusinessUploadListPage?busid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57773 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57772 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57771 | Medium | 2025-01-16 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-57770 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. |
| CVE-2024-57769 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. |
| CVE-2024-57768 | Critical | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key. |
| CVE-2024-12351 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. |
| CVE-2024-12350 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the argument content leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-12349 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tag/save. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-53477 | Critical | 2024-12-02 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
| CVE-2024-8782 | Medium | 2024-09-13 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-8706 | Medium | 2024-09-12 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-8694 | Medium | 2024-09-11 | Not applicable | Proof of concept only | A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-40322 | High | 2024-07-16 | Not applicable | Proof of concept only | An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data |
| CVE-2024-5379 | Medium | 2024-05-26 | Not applicable | No public exploit | A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266291. |
| CVE-2024-5310 | Medium | 2024-05-24 | Not applicable | Proof of concept only | A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266121 was assigned to this vulnerability. |
| CVE-2023-51254 | Medium | 2024-04-29 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component. |
| CVE-2024-2568 | High | 2024-03-17 | Not applicable | Proof of concept only | A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071. |
| CVE-2024-24375 | High | 2024-03-07 | Not applicable | Proof of concept only | SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. |
| CVE-2024-24029 | Critical | 2024-02-02 | Not applicable | Proof of concept only | JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data. |
| CVE-2024-22494 | Medium | 2024-01-12 | Not applicable | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2023-50136 | Medium | 2024-01-09 | Not applicable | Proof of concept only | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. |
| CVE-2023-47503 | Critical | 2023-11-28 | Not applicable | No public exploit | An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module. |
| CVE-2023-41599 | Medium | 2023-09-19 | Not applicable | Exploited | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. |
| CVE-2023-34645 | High | 2023-06-16 | Not applicable | Proof of concept only | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
| CVE-2023-24747 | Medium | 2023-04-05 | Not applicable | No public exploit | Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. |
| CVE-2023-0758 | Critical | 2023-02-09 | Not applicable | No public exploit | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability. |
| CVE-2023-22975 | Medium | 2023-02-03 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html. |
| CVE-2022-37202 | High | 2022-10-26 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list |
| CVE-2022-37208 | High | 2022-10-13 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37209 | High | 2022-09-27 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37205 | High | 2022-09-20 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37204 | Critical | 2022-09-20 | Not applicable | Proof of concept only | Final CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-37203 | Critical | 2022-09-19 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37207 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection |
| CVE-2022-37201 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-38286 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. |
| CVE-2022-38285 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. |
| CVE-2022-38284 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. |
| CVE-2022-38283 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. |
| CVE-2022-38282 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. |
| CVE-2022-38281 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. |
| CVE-2022-38280 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. |
| CVE-2022-38279 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. |
| CVE-2022-38278 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. |
| CVE-2022-38277 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. |
| CVE-2022-38276 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. |
| CVE-2022-38275 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. |
| CVE-2022-38274 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. |
| CVE-2022-38273 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. |
| CVE-2022-38272 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. |
| CVE-2022-34928 | High | 2022-08-03 | Not applicable | No public exploit | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
| CVE-2022-33114 | High | 2022-06-23 | Not applicable | No public exploit | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. |
| CVE-2021-42242 | Critical | 2022-05-05 | Not applicable | No public exploit | A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor. |
| CVE-2022-28505 | High | 2022-05-03 | Not applicable | No public exploit | Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java. |
| CVE-2022-27341 | Critical | 2022-04-22 | Not applicable | No public exploit | JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. |
| CVE-2022-27111 | Medium | 2022-04-11 | Not applicable | No public exploit | Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it. |
| CVE-2021-40645 | Medium | 2022-03-30 | Not applicable | No public exploit | An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController. |
| CVE-2021-46087 | Medium | 2022-01-25 | Not applicable | No public exploit | In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code. |
| CVE-2021-37262 | High | 2021-12-16 | Not applicable | No public exploit | JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. |
| CVE-2021-40639 | High | 2021-09-15 | Not applicable | No public exploit | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. |
| CVE-2020-19155 | High | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19154 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19151 | High | 2021-09-15 | Not applicable | No public exploit | Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'. |
| CVE-2020-19150 | High | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19148 | Medium | 2021-09-15 | Not applicable | No public exploit | Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/jfinal_cms/front/person/profile.html'. |
| CVE-2020-19147 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'. |
| CVE-2020-19146 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'. |