Jfinal CMS
53 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Jfinal CMS, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Jfinal CMS CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 3 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 1 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 53 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical9
- High30
- Medium14
Latest CVEs
The 15 most recently published vulnerabilities affecting Jfinal CMS.
- CVE-2025-6105jflyfox jfinal_cms HOME.java cross-site request forgery4.3
- CVE-2024-12350JFinalCMS Template TemplateController.java update command injection6.3
- CVE-2024-12349JFinalCMS save cross-site request forgery4.3
- CVE-2024-53477JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java9.8
- CVE-2023-47503An issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp component in the template management module.9.8
- CVE-2023-34645jfinal CMS 5.1.0 has an arbitrary file read vulnerability.7.5
- CVE-2023-30349JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.9.8
- CVE-2023-24747Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list.5.4
- CVE-2023-22975A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person...6.1
- CVE-2022-37202JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list8.8
- CVE-2022-37208JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.8.8
- CVE-2022-37209JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.8.8
- CVE-2022-37205JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.8.8
- CVE-2022-37204Final CMS 5.1.0 is vulnerable to SQL Injection.9.8
- CVE-2022-37203JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.9.8
Product grouping is registry-driven, with AI assist and human review. How it works