Skip to content
Noroxi

jflyfox records

51 published records for vendor jflyfox.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
5
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

51 records
  • CVE-2021-42242
    40Plan

    A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor.

    CriticalCVSS 9.8No exploitEPSS 2%

    jflyfox · jfinal cmsMay 5, 2022

  • CVE-2022-37203
    39Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    jflyfox · jfinal cmsSep 19, 2022

  • CVE-2023-30349
    39Monitor

    JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.

    CriticalCVSS 9.8No exploitEPSS 1%

    jflyfox · jfinal cmsApr 27, 2023

  • CVE-2022-37204
    39Monitor

    Final CMS 5.1.0 is vulnerable to SQL Injection.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    jflyfox · jfinal cmsSep 20, 2022

  • CVE-2023-47503
    39Monitor

    An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in

    CriticalCVSS 9.8No exploitEPSS 1%

    jflyfox · jfinal cmsNov 27, 2023

  • CVE-2022-30500
    39Monitor

    Jfinal cms 5.1.0 is vulnerable to SQL Injection.

    CriticalCVSS 9.8No exploitEPSS 1%

    jflyfox · jfinal cmsMay 26, 2022

  • CVE-2022-37199
    39Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.

    CriticalCVSS 9.8No exploitEPSS 0%

    jflyfox · jfinal cmsAug 23, 2022

  • CVE-2022-37223
    39Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.

    CriticalCVSS 9.8No exploitEPSS 0%

    jflyfox · jfinal cmsAug 23, 2022

  • CVE-2024-53477
    39Monitor

    JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java

    CriticalCVSS 9.8No exploitEPSS 0%

    jflyfox · jfinal cmsDec 2, 2024

  • CVE-2020-19155
    37Monitor

    Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary co

    HighCVSS 8.8No exploitEPSS 7%

    jflyfox · jfinal cmsSep 15, 2021

  • CVE-2020-19151
    37Monitor

    Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template

    HighCVSS 8.8No exploitEPSS 5%

    jflyfox · jfinal cmsSep 15, 2021

  • CVE-2022-37205
    35Monitor

    JFinal CMS 5.1.0 is affected by: SQL Injection.

    HighCVSS 8.8Proof of conceptEPSS 1%

    jflyfox · jfinal cmsSep 20, 2022

  • CVE-2022-37201
    35Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection.

    HighCVSS 8.8Proof of conceptEPSS 1%

    jflyfox · jfinal cmsSep 15, 2022

  • CVE-2022-37207
    35Monitor

    JFinal CMS 5.1.0 is affected by: SQL Injection.

    HighCVSS 8.8Proof of conceptEPSS 1%

    jflyfox · jfinal cmsSep 15, 2022

  • CVE-2022-37209
    35Monitor

    JFinal CMS 5.1.0 is affected by: SQL Injection.

    HighCVSS 8.8Proof of conceptEPSS 1%

    jflyfox · jfinal cmsSep 27, 2022

  • CVE-2022-37208
    35Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection.

    HighCVSS 8.8Proof of conceptEPSS 1%

    jflyfox · jfinal cmsOct 13, 2022

  • CVE-2022-37202
    35Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list

    HighCVSS 8.8Proof of conceptEPSS 1%

    jflyfox · jfinal cmsOct 26, 2022

  • CVE-2022-34928
    35Monitor

    JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.

    HighCVSS 8.8No exploitEPSS 0%

    jflyfox · jfinal cmsAug 2, 2022

  • CVE-2020-19150
    33Monitor

    Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of servic

    HighCVSS 8.1No exploitEPSS 3%

    jflyfox · jfinal cmsSep 15, 2021

  • CVE-2021-40639
    30Monitor

    Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemana

    HighCVSS 7.5No exploitEPSS 1%

    jflyfox · jfinal cmsSep 15, 2021

  • CVE-2021-37262
    30Monitor

    JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.

    HighCVSS 7.5No exploitEPSS 1%

    jflyfox · jfinal cmsDec 16, 2021

  • CVE-2023-34645
    30Monitor

    jfinal CMS 5.1.0 has an arbitrary file read vulnerability.

    HighCVSS 7.5No exploitEPSS 0%

    jflyfox · jfinal cmsJun 16, 2023

  • CVE-2022-38275
    28Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.

    HighCVSS 7.2No exploitEPSS 1%

    jflyfox · jfinal cmsSep 9, 2022

  • CVE-2022-38278
    28Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.

    HighCVSS 7.2No exploitEPSS 1%

    jflyfox · jfinal cmsSep 9, 2022

  • CVE-2022-38273
    28Monitor

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.

    HighCVSS 7.2No exploitEPSS 1%

    jflyfox · jfinal cmsSep 9, 2022