JFinalCMS vulnerabilities

2 known vulnerabilities in JFinalCMS from Heyewei. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Jfinalcms: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-57665Jan 29, 2025Heyewei

  JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering.

• 7.2 High severity

  JFinalCMS: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-2568Mar 17, 2024Heyewei

  A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injecti