WaratekVRT Sign in

Com.jfinal CVEs

36 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Vendor com.jfinal✕
Overview 36 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
36matches 2protected5.6% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 5.6% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 34 94.4%
Critical 2 5.6% High 21 58.3% Medium 13 36.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 5.6% partly blocked 0 0.0% not blocked 34 94.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 4 11.1% Forecast only 0 0.0% No public exploit 32 88.9%
split by peak 27 / quarter
No exploit published: 34Protected by Waratek: 2 Medium: 13High: 21Critical: 2 not blocked: 34blocked by ARMR today: 2 No public exploit: 32Proof of concept only: 4
Q4 191 No exploit published1 High1 not blocked1 No public exploit1 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 212 Protected by Waratek1 No exploit published1 Critical1 Medium1 blocked by ARMR today1 not blocked1 No public exploit2 Q3 210 Q4 210 Q1 220 Q2 221 No exploit published1 Medium1 not blocked1 No public exploit1 Q3 220 Q4 220 Q1 230 Q2 231 No exploit published1 Critical1 not blocked1 No public exploit1 Q3 230 Q4 2327 Protected by Waratek1 No exploit published26 High20 Medium7 blocked by ARMR today1 not blocked26 No public exploit27 Q1 244 No exploit published4 Medium4 not blocked4 Proof of concept only4
Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24
36 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-22497 Medium 2024-01-23 No exploit published Proof of concept only Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
CVE-2024-22496 Medium 2024-01-23 No exploit published Proof of concept only Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.
CVE-2024-22493 Medium 2024-01-12 No exploit published Proof of concept only A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.
CVE-2024-22492 Medium 2024-01-12 No exploit published Proof of concept only A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.
CVE-2023-50137 Medium 2023-12-14 No exploit published No public exploit JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
CVE-2023-50102 Medium 2023-12-14 No exploit published No public exploit JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-50101 Medium 2023-12-14 No exploit published No public exploit JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
CVE-2023-50100 Medium 2023-12-14 No exploit published No public exploit JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
CVE-2023-50449 High 2023-12-10 Protected by Waratek No public exploit JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter.
CVE-2023-49487 Medium 2023-12-08 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.
CVE-2023-49486 Medium 2023-12-08 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.
CVE-2023-49485 Medium 2023-12-08 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.
CVE-2023-49448 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.
CVE-2023-49447 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.
CVE-2023-49446 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
CVE-2023-49398 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.
CVE-2023-49397 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.
CVE-2023-49396 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.
CVE-2023-49395 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.
CVE-2023-49383 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.
CVE-2023-49382 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.
CVE-2023-49381 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.
CVE-2023-49380 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.
CVE-2023-49379 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.
CVE-2023-49378 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.
CVE-2023-49377 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.
CVE-2023-49376 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.
CVE-2023-49375 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.
CVE-2023-49374 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.
CVE-2023-49373 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.
CVE-2023-49372 High 2023-12-05 No exploit published No public exploit JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.
CVE-2021-31635 Critical 2023-06-26 No exploit published No public exploit Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.
CVE-2022-33113 Medium 2022-06-23 No exploit published No public exploit Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
CVE-2021-33348 Medium 2021-06-24 No exploit published No public exploit An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.
CVE-2021-31649 Critical 2021-06-24 Protected by Waratek No public exploit In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute
CVE-2019-17352 High 2019-10-08 No exploit published No public exploit In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.