# com.jfinal:jfinal (Maven) vulnerabilities 36 known vulnerabilities (5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/com.jfinal/jfinal ## Advisories (36) ### [CVE-2024-22497](https://cve.now/CVE-2024-22497): Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via… - Severity: Medium 6.1 - Published: Jan 23, 2024 - Affected: through 5.0.0. ### [CVE-2024-22496](https://cve.now/CVE-2024-22496): Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. - Severity: Medium 6.1 - Published: Jan 23, 2024 - Affected: through 5.0.0. ### [CVE-2024-22493](https://cve.now/CVE-2024-22493): A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject… - Severity: Medium 5.4 - Published: Jan 12, 2024 - Affected: through 5.0.0. ### [CVE-2024-22492](https://cve.now/CVE-2024-22492): A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject… - Severity: Medium 5.4 - Published: Jan 12, 2024 - Affected: through 5.0.0. ### [CVE-2023-50137](https://cve.now/CVE-2023-50137): JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. - Severity: Unrated - Published: Dec 14, 2023 - Affected: through 5.0.0. ### [CVE-2023-50102](https://cve.now/CVE-2023-50102): JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). - Severity: Unrated - Published: Dec 14, 2023 - Affected: through 5.0.0. ### [CVE-2023-50101](https://cve.now/CVE-2023-50101): JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. - Severity: Unrated - Published: Dec 14, 2023 - Affected: through 5.0.0. ### [CVE-2023-50100](https://cve.now/CVE-2023-50100): JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. - Severity: Unrated - Published: Dec 14, 2023 - Affected: through 5.0.0. ### [CVE-2023-50449](https://cve.now/CVE-2023-50449): JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. - Severity: Unrated - Published: Dec 10, 2023 - Affected: through 5.0.0. ### [CVE-2023-49487](https://cve.now/CVE-2023-49487): JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. - Severity: Unrated - Published: Dec 8, 2023 - Affected: through 5.0.0. ### [CVE-2023-49486](https://cve.now/CVE-2023-49486): JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. - Severity: Unrated - Published: Dec 8, 2023 - Affected: through 5.0.0. ### [CVE-2023-49485](https://cve.now/CVE-2023-49485): JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. - Severity: Medium 5.4 - Published: Dec 8, 2023 - Affected: through 5.0.0. ### [CVE-2023-49448](https://cve.now/CVE-2023-49448): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49447](https://cve.now/CVE-2023-49447): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49446](https://cve.now/CVE-2023-49446): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49398](https://cve.now/CVE-2023-49398): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49397](https://cve.now/CVE-2023-49397): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49396](https://cve.now/CVE-2023-49396): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49395](https://cve.now/CVE-2023-49395): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49383](https://cve.now/CVE-2023-49383): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49382](https://cve.now/CVE-2023-49382): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49381](https://cve.now/CVE-2023-49381): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49380](https://cve.now/CVE-2023-49380): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend\_link/delete. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49379](https://cve.now/CVE-2023-49379): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend\_link/save. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49378](https://cve.now/CVE-2023-49378): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49377](https://cve.now/CVE-2023-49377): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49376](https://cve.now/CVE-2023-49376): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49375](https://cve.now/CVE-2023-49375): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend\_link/update. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49374](https://cve.now/CVE-2023-49374): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49373](https://cve.now/CVE-2023-49373): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2023-49372](https://cve.now/CVE-2023-49372): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save. - Severity: Unrated - Published: Dec 5, 2023 - Affected: through 5.0.0. ### [CVE-2021-31635](https://cve.now/CVE-2021-31635): Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template… - Severity: Unrated - Published: Jun 26, 2023 - Affected: through 4.9.08. ### [CVE-2022-33113](https://cve.now/CVE-2022-33113): Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field… - Severity: Unrated - Published: Jun 23, 2022 - Affected: through 5.1.0. ### [CVE-2021-31649](https://cve.now/CVE-2021-31649): In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code… - Severity: Unrated - Published: Jun 24, 2021 - Affected: through 4.9.08. ### [CVE-2021-33348](https://cve.now/CVE-2021-33348): An issue was discovered in JFinal framework v4.9.10 and below. - Severity: Unrated - Published: Jun 24, 2021 - Affected: fixed in 4.9.11. ### [CVE-2019-17352](https://cve.now/CVE-2019-17352): In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload… - Severity: Unrated - Published: Oct 8, 2019 - Affected: fixed in 4.5. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/com.jfinal:jfinal Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.