Threats affecting pkg:github/jflyfox/jfinal_cms

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.2%	CVE-2026-11473jflyfox jfinal_cms · SQL Injection Medium5.3EPSS 0.2%2026-06-08CVE Database V5CVE-2026-11473 CVE-2026-11473 is a medium severity SQL injection vulnerability in jflyfox jfinal_cms affecting versions 5.0 and 5.1.0. The flaw exists in the AdvicefeedbackController.java file's list function, where manipulation of the orderBy argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. No official patch or remediation has been announced by the vendor as of the publication date. EPSS 0.2%Vulnerability	CVE Database V5	2026-06-08
Critical	9.8	EPSS 0.9%	CVE-2024-53477jfinal_cms · Deserialization of Untrusted Data Critical9.8EPSS 0.9%2024-12-02CVE Database V5CVE-2024-53477 JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java EPSS 0.9%Vulnerability CWE-502	CVE Database V5	2024-12-02

Page 1 of 1