Vulnerabilities (CVE)

Filtered by vendor Jflyfox Subscribe
Filtered by product Jfinal Cms
Total 49 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-40639 1 Jflyfox 1 Jfinal Cms 2024-11-21 5.0 MEDIUM 7.5 HIGH
Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.
CVE-2021-37262 1 Jflyfox 1 Jfinal Cms 2024-11-21 5.0 MEDIUM 7.5 HIGH
JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.
CVE-2020-19155 1 Jflyfox 1 Jfinal Cms 2024-11-21 6.5 MEDIUM 8.8 HIGH
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'.
CVE-2020-19154 1 Jflyfox 1 Jfinal Cms 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'.
CVE-2020-19151 1 Jflyfox 1 Jfinal Cms 2024-11-21 6.5 MEDIUM 8.8 HIGH
Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'.
CVE-2020-19150 1 Jflyfox 1 Jfinal Cms 2024-11-21 5.5 MEDIUM 8.1 HIGH
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'.
CVE-2020-19148 1 Jflyfox 1 Jfinal Cms 2024-11-21 3.5 LOW 5.4 MEDIUM
Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/jfinal_cms/front/person/profile.html'.
CVE-2020-19147 1 Jflyfox 1 Jfinal Cms 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'.
CVE-2020-19146 1 Jflyfox 1 Jfinal Cms 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'.