CVE-2024-5379

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266291.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	JFinalCMS	20240111
jfinalcms_project	jfinalcms	<= 20240111

References

https://gitee.com/heyewei/JFinalcms/issues/I8VHGRExploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.266291Permissions Required, VDB Entry
https://vuldb.com/?id.266291Third Party Advisory, VDB Entry
https://gitee.com/heyewei/JFinalcms/issues/I8VHGRExploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.266291Permissions Required, VDB Entry
https://vuldb.com/?id.266291Third Party Advisory, VDB Entry

Timeline

Published: May 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-537907.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS le CVE-2024-537916.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) CVE-2024-537928.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injectio CVE-2024-537938.2Cross-Site Request Forgery (CSRF) vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows Blind SQL Injection.This issue affect CVE-2024-537946.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks allows S CVE-2024-537955.3Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Accessing Functionality Not Properly Constrained by ACLs.CVE-2024-537965.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-eleme CVE-2024-537975.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-b CVE-2024-537985.4Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion.This issue affects FloristPress: from n/a CVE-2024-537994.3Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured A CVE-2024-53803.5A vulnerability classified as problematic has been found in jsy-1 short-url 1.0.0. Affected is an unknown function of the file admin.php. Th CVE-2024-538008.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in rezgo Rezgo rezgo a