Threat database

CVE-2026-11473 is a medium severity SQL injection vulnerability in jflyfox jfinal_cms affecting versions 5.0 and 5.1.0. The flaw exists in the AdvicefeedbackController.java file's list function, where manipulation of the orderBy argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. No official patch or remediation has been announced by the vendor as of the publication date.

A vulnerability has been found in jflyfox jfinal_cms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.