Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2532▼ 363 respecto a la semana anterior
Críticas / altas1340▲ 76 respecto a la semana anterior
Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior
11 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Analizada | Media (4.6) | 0.28% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |
| Modificada | Alta (8.8) | 0.59% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid. | |
| Analizada | Media (4.8) | 0.29% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | A cross-site scripting (XSS) vulnerability in the getBusinessUploadListPage?busid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |
| Analizada | Media (4.8) | 0.29% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |
| Analizada | Media (4.8) | 0.29% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |
| Analizada | Media (4.8) | 0.32% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |
| Modificada | Alta (8.8) | 0.59% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. | |
| Modificada | Alta (8.8) | 0.59% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. | |
| Analizada | Crítica (9.8) | 0.50% | — | Jfinaloa Project Jfinaloa | 16/1/2025 | 17/6/2026 | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key. | |
| Modificada | Crítica (9.8) | 0.61% | — | Jfinaloa Project Jfinaloa | 9/2/2023 | 17/6/2026 | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been… | |
| Modificada | Media (6.5) | 1.1% | — | Jfinaloa Project Jfinaloa | 30/3/2022 | 17/6/2026 | An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController. |