Jfinalcms Project
Jfinalcms Project Jfinalcms: vulnerabilidades y CVE
Jfinalcms Project Jfinalcms tiene 39 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE39
Últimos 12 meses0
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-40322 | Alta (8.8) | 0.43% | — | 16 jul 2024 | An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data |
| CVE-2023-51254 | Media (6.1) | 0.55% | — | 29 abr 2024 | Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component. |
| CVE-2024-24375 | Alta (7.5) | 0.48% | — | 7 mar 2024 | SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. |
| CVE-2024-24029 | Crítica (9.8) | 0.76% | — | 2 feb 2024 | JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data. |
| CVE-2024-22497 | Media (6.1) | 0.43% | — | 23 ene 2024 | Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. |
| CVE-2024-22496 | Media (6.1) | 0.43% | — | 23 ene 2024 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. |
| CVE-2024-22494 | Media (5.4) | 0.47% | — | 12 ene 2024 | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2024-22493 | Media (5.4) | 0.56% | — | 12 ene 2024 | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2024-22492 | Media (5.4) | 0.56% | — | 12 ene 2024 | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2023-50136 | Media (5.4) | 0.41% | — | 9 ene 2024 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. |
| CVE-2023-50137 | Media (5.4) | 0.46% | — | 14 dic 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. |
| CVE-2023-50102 | Media (5.4) | 0.43% | — | 14 dic 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). |
| CVE-2023-50101 | Media (5.4) | 0.44% | — | 14 dic 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. |
| CVE-2023-50100 | Media (5.4) | 0.44% | — | 14 dic 2023 | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. |
| CVE-2023-50449 | Alta (7.5) | 1.2% | — | 10 dic 2023 | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. |
| CVE-2023-49487 | Media (5.4) | 0.41% | — | 8 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. |
| CVE-2023-49486 | Media (5.4) | 0.42% | — | 8 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. |
| CVE-2023-49485 | Media (5.4) | 0.41% | — | 8 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. |
| CVE-2023-49448 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete. |
| CVE-2023-49447 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update. |
| CVE-2023-49446 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save. |
| CVE-2023-49398 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete. |
| CVE-2023-49397 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus. |
| CVE-2023-49396 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save. |
| CVE-2023-49395 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update. |
| CVE-2023-49383 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. |
| CVE-2023-49382 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete. |
| CVE-2023-49381 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update. |
| CVE-2023-49380 | Alta (8.8) | 0.39% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete. |
| CVE-2023-49379 | Alta (8.8) | 0.40% | — | 5 dic 2023 | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save. |