https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-57776.htmlhttps://patchthecve.com/cve/CVE-2024-57776.htmlWed, 17 Jun 2026 08:14:01 +0000MEDIUM 4.6: A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.https://patchthecve.com/cve/CVE-2024-57775.htmlhttps://patchthecve.com/cve/CVE-2024-57775.htmlWed, 17 Jun 2026 08:14:01 +0000HIGH 8.8: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid.https://patchthecve.com/cve/CVE-2024-57774.htmlhttps://patchthecve.com/cve/CVE-2024-57774.htmlWed, 17 Jun 2026 08:14:01 +0000MEDIUM 4.8: A cross-site scripting (XSS) vulnerability in the getBusinessUploadListPage?busid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.https://patchthecve.com/cve/CVE-2024-57773.htmlhttps://patchthecve.com/cve/CVE-2024-57773.htmlWed, 17 Jun 2026 08:14:01 +0000MEDIUM 4.8: A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.https://patchthecve.com/cve/CVE-2024-57772.htmlhttps://patchthecve.com/cve/CVE-2024-57772.htmlWed, 17 Jun 2026 08:14:01 +0000MEDIUM 4.8: A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.https://patchthecve.com/cve/CVE-2024-57771.htmlhttps://patchthecve.com/cve/CVE-2024-57771.htmlWed, 17 Jun 2026 08:14:01 +0000MEDIUM 4.8: A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.https://patchthecve.com/cve/CVE-2024-57770.htmlhttps://patchthecve.com/cve/CVE-2024-57770.htmlWed, 17 Jun 2026 08:14:00 +0000HIGH 8.8: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id.https://patchthecve.com/cve/CVE-2024-57769.htmlhttps://patchthecve.com/cve/CVE-2024-57769.htmlWed, 17 Jun 2026 08:14:00 +0000HIGH 8.8: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser.https://patchthecve.com/cve/CVE-2024-57768.htmlhttps://patchthecve.com/cve/CVE-2024-57768.htmlWed, 17 Jun 2026 08:14:00 +0000CRITICAL 9.8: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key.https://patchthecve.com/cve/CVE-2023-0758.htmlhttps://patchthecve.com/cve/CVE-2023-0758.htmlWed, 28 Oct 2026 19:10:00 +0000MEDIUM 6.3: A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exp