Jflyfox
37 CVEs tracked since 2021. Since Sep 2021, none of them reached CISA KEV.
Jflyfox CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2021-09 | 8 | 0 |
| 2021-10 | null or fewer | |
| 2021-11 | null or fewer | |
| 2021-12 | null or fewer | |
| 2022-01 | null or fewer | |
| 2022-02 | null or fewer | |
| 2022-03 | null or fewer | |
| 2022-04 | null or fewer | |
| 2022-05 | 4 | 0 |
| 2022-06 | null or fewer | |
| 2022-07 | null or fewer | |
| 2022-08 | 4 | 0 |
| 2022-09 | 21 | 0 |
Products
The products that kept showing up in Jflyfox's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Jflyfox.
- CVE-2026-11473jflyfox jfinal_cms AdvicefeedbackController.java list sql injection6.3
- CVE-2025-6105jflyfox jfinal_cms HOME.java cross-site request forgery4.3
- CVE-2024-53477JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java9.8
- CVE-2023-47503An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module.9.8
- CVE-2023-34645jfinal CMS 5.1.0 has an arbitrary file read vulnerability.7.5
- CVE-2023-30349JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.9.8
- CVE-2023-24747Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list.5.4
- CVE-2023-22975A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person...6.1
- CVE-2022-37202JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list8.8
- CVE-2022-37208JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.8.8
- CVE-2022-37209JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.8.8
- CVE-2022-37205JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.8.8
- CVE-2022-37204Final CMS 5.1.0 is vulnerable to SQL Injection.9.8
- CVE-2022-37203JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.9.8
- CVE-2022-37201JFinal CMS 5.1.0 is vulnerable to SQL Injection.8.8
The record
- Peak rank
- #42 in Sep 2022
- Busiest month shown
- Sep 2022, 21 CVEs
- Months with a KEV entry
- 0 since Sep 2021
- Monthly snapshots
- 4 since 2021