WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product jfinal cms✕
Overview 30 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
30matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 30 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 30 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 30 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 4 13.3% Forecast only 0 0.0% No public exploit 26 86.7%
split by peak 20 / quarter
Not applicable: 30 High: 30 not blocked: 30 No public exploit: 26Proof of concept only: 4
Q3 214 Not applicable4 High4 not blocked4 No public exploit4 Q4 211 Not applicable1 High1 not blocked1 No public exploit1 Q1 220 Q2 222 Not applicable2 High2 not blocked2 No public exploit2 Q3 2220 Not applicable20 High20 not blocked20 Proof of concept only1 No public exploit19 Q4 222 Not applicable2 High2 not blocked2 Proof of concept only2 Q1 230 Q2 231 Not applicable1 High1 not blocked1 Proof of concept only1
Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22Q1 23Q2 23
30 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-34645 High 2023-06-16 Not applicable Proof of concept only jfinal CMS 5.1.0 has an arbitrary file read vulnerability.
CVE-2022-37202 High 2022-10-26 Not applicable Proof of concept only JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list
CVE-2022-37208 High 2022-10-13 Not applicable Proof of concept only JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
CVE-2022-37209 High 2022-09-27 Not applicable No public exploit JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
CVE-2022-37205 High 2022-09-20 Not applicable Proof of concept only JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
CVE-2022-37207 High 2022-09-15 Not applicable No public exploit JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection
CVE-2022-37201 High 2022-09-15 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection.
CVE-2022-38286 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.
CVE-2022-38285 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.
CVE-2022-38284 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.
CVE-2022-38283 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.
CVE-2022-38282 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.
CVE-2022-38281 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.
CVE-2022-38280 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.
CVE-2022-38279 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.
CVE-2022-38278 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.
CVE-2022-38277 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
CVE-2022-38276 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.
CVE-2022-38275 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.
CVE-2022-38274 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.
CVE-2022-38273 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.
CVE-2022-38272 High 2022-09-09 Not applicable No public exploit JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.
CVE-2022-34928 High 2022-08-03 Not applicable No public exploit JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.
CVE-2022-33114 High 2022-06-23 Not applicable No public exploit Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list.
CVE-2022-28505 High 2022-05-03 Not applicable No public exploit Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java.
CVE-2021-37262 High 2021-12-16 Not applicable No public exploit JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.
CVE-2021-40639 High 2021-09-15 Not applicable No public exploit Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.
CVE-2020-19155 High 2021-09-15 Not applicable No public exploit Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'.
CVE-2020-19151 High 2021-09-15 Not applicable No public exploit Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'.
CVE-2020-19150 High 2021-09-15 Not applicable No public exploit Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'.