https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-57665.htmlhttps://patchthecve.com/cve/CVE-2024-57665.htmlWed, 17 Jun 2026 08:13:53 +0000CRITICAL 9.8: JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering.https://patchthecve.com/cve/CVE-2024-8782.htmlhttps://patchthecve.com/cve/CVE-2024-8782.htmlWed, 17 Jun 2026 08:23:17 +0000MEDIUM 6.3: A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public https://patchthecve.com/cve/CVE-2024-8694.htmlhttps://patchthecve.com/cve/CVE-2024-8694.htmlWed, 17 Jun 2026 08:23:07 +0000LOW 3.8: A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is posshttps://patchthecve.com/cve/CVE-2024-5379.htmlhttps://patchthecve.com/cve/CVE-2024-5379.htmlWed, 17 Jun 2026 08:15:49 +0000LOW 3.5: A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclohttps://patchthecve.com/cve/CVE-2024-5310.htmlhttps://patchthecve.com/cve/CVE-2024-5310.htmlWed, 17 Jun 2026 08:15:40 +0000LOW 2.4: A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the phttps://patchthecve.com/cve/CVE-2024-2568.htmlhttps://patchthecve.com/cve/CVE-2024-2568.htmlWed, 17 Jun 2026 07:24:48 +0000MEDIUM 4.7: A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely.