Threats affecting pkg:github/againstthelight/jfinal_cms

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.3	EPSS 0.2%	CVE-2026-11473jflyfox jfinal_cms · SQL Injection Medium5.3EPSS 0.2%2026-06-08CVE Database V5CVE-2026-11473 CVE-2026-11473 is a medium severity SQL injection vulnerability in jflyfox jfinal_cms affecting versions 5.0 and 5.1.0. The flaw exists in the AdvicefeedbackController.java file's list function, where manipulation of the orderBy argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. No official patch or remediation has been announced by the vendor as of the publication date. EPSS 0.2%Vulnerability	CVE Database V5	2026-06-08
Critical	9.8	EPSS 0.9%	CVE-2024-53477jfinal_cms · Deserialization of Untrusted Data Critical9.8EPSS 0.9%2024-12-02CVE Database V5CVE-2024-53477 JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java EPSS 0.9%Vulnerability CWE-502	CVE Database V5	2024-12-02
Critical	9.8	EPSS 1.5%	CVE-2022-37204Final CMS · SQL Injection Critical9.8EPSS 1.5%2022-09-20CVE Database V5CVE-2022-37204 Final CMS 5.1.0 is vulnerable to SQL Injection. EPSS 1.5%Vulnerability CWE-89	CVE Database V5	2022-09-20

Page 1 of 1