Jflyfox
Jflyfox Jfinal CMS: vulnerabilidades y CVE
Jflyfox Jfinal CMS tiene 52 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 9 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE52
Últimos 12 meses1
Críticas9
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-11473 | Media (5.3) | 0.20% | — | 8 jun 2026 | A vulnerability was identified in jflyfox jfinal_cms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack… |
| CVE-2025-6105 | Baja (2.1) | 0.31% | — | 16 jun 2025 | A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site… |
| CVE-2024-53477 | Crítica (9.8) | 0.88% | — | 2 dic 2024 | JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java |
| CVE-2023-47503 | Crítica (9.8) | 1.3% | — | 28 nov 2023 | An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module. |
| CVE-2023-34645 | Alta (7.5) | 0.80% | — | 16 jun 2023 | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
| CVE-2023-30349 | Crítica (9.8) | 1.6% | — | 27 abr 2023 | JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function. |
| CVE-2023-24747 | Media (5.4) | 0.37% | — | 5 abr 2023 | Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. |
| CVE-2023-22975 | Media (6.1) | 0.42% | — | 3 feb 2023 | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html. |
| CVE-2022-37202 | Alta (8.8) | 1.1% | — | 26 oct 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list |
| CVE-2022-37208 | Alta (8.8) | 1.2% | — | 13 oct 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37209 | Alta (8.8) | 1.5% | — | 27 sept 2022 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37205 | Alta (8.8) | 1.6% | — | 20 sept 2022 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37204 | Crítica (9.8) | 1.4% | — | 20 sept 2022 | Final CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-37203 | Crítica (9.8) | 1.6% | — | 19 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37201 | Alta (8.8) | 1.6% | — | 15 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-37207 | Alta (8.8) | 1.6% | — | 15 sept 2022 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection |
| CVE-2022-38286 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. |
| CVE-2022-38285 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. |
| CVE-2022-38284 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. |
| CVE-2022-38283 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. |
| CVE-2022-38282 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. |
| CVE-2022-38281 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. |
| CVE-2022-38280 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. |
| CVE-2022-38279 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. |
| CVE-2022-38278 | Alta (7.2) | 1.2% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. |
| CVE-2022-38277 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. |
| CVE-2022-38276 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. |
| CVE-2022-38275 | Alta (7.2) | 1.2% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. |
| CVE-2022-38274 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. |
| CVE-2022-38273 | Alta (7.2) | 1.1% | — | 9 sept 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. |