Heyewei Jfinalcms
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Heyewei Jfinalcms.
By the Year
In 2026 there have been 1 vulnerability in Heyewei Jfinalcms with an average score of 2.4 out of ten. Last year, in 2025 Jfinalcms had 1 security vulnerability published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Jfinalcms in 2026 could surpass last years number.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1 | 2.40 |
| 2025 | 1 | 0.00 |
| 2024 | 6 | 6.86 |
It may take a day or so for new Jfinalcms vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Heyewei Jfinalcms Security Vulnerabilities
JFinalCMS 5.0.0 /admin/admin/save XSS Remote API Vulnerability
CVE-2026-2200
2.4 - Low
- February 09, 2026
A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
XSS
JFinalCMS 1.0 SQLi via RC Content.java title param
CVE-2024-57665
- January 29, 2025
JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering.
JFinalCMS pre-1.0 Path Traversal in /admin/template/edit (CR)
CVE-2024-8782
9.8 - Critical
- September 13, 2024
A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Directory traversal
JFinalCMS Path Traversal via /admin/template/update remote exploit
CVE-2024-8706
6.5 - Medium
- September 12, 2024
A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Directory traversal
JFinalCMS path traversal via /admin/template/update fileName (CVE-2024-8694)
CVE-2024-8694
- September 11, 2024
A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Directory traversal
Remote XSS in JFinalCMS /admin/template
CVE-2024-5379
5.4 - Medium
- May 26, 2024
A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266291.
XSS
Remote XSS via Title param in JFinalCMS /admin/content
CVE-2024-5310
5.4 - Medium
- May 24, 2024
A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266121 was assigned to this vulnerability.
JFinalCMS 5.0.0 SQLi via /admin/div_data/delete
CVE-2024-2568
7.2 - High
- March 17, 2024
A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071.
SQL Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Heyewei Jfinalcms or by Heyewei? Click the Watch button to subscribe.
