CVE-2024-2568

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
heyewei	JFinalCMS	5.0.0
jfinalcms_project	jfinalcms	5.0.0

References

https://github.com/bigbigbigbaby/cms/blob/main/5.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.257071Permissions Required, VDB Entry
https://vuldb.com/?id.257071Third Party Advisory, VDB Entry
https://github.com/bigbigbigbaby/cms/blob/main/5.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.257071Permissions Required, VDB Entry
https://vuldb.com/?id.257071Third Party Advisory, VDB Entry

Timeline

Published: Mar 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-25699.8A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some u CVE-2024-256904.7There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker CVE-2024-256916.1There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 and below which may allow a remote, unauthenticated attacker CVE-2024-256925.4There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote,CVE-2024-256939.9There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to CVE-2024-256944.8There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 11.1 and below that may allow a remote, a CVE-2024-256957.2There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.2 and below that may allow a remote, authenticated attacke CVE-2024-256964.8There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacke CVE-2024-256975.4There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacke CVE-2024-256986.1There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linu CVE-2024-256998.5There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on CVE-2024-25709.8A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been classified as critical. This affects an unknown