VulnerabilityModified
CVE-2021-46087
In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS.
MEDIUM 5.4EPSS 0.50%
Does this matter?
Lower severity and a low EPSS score (0.50%). Track it; it rarely justifies an emergency change on its own.
Description
In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.50% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- jflyfox/jfinal cms
- Source
- cve@mitre.org
References
- https://github.com/jflyfox/jfinal_cms/issues/19Exploit, Issue Tracking, Third Party Advisory
- https://github.com/jflyfox/jfinal_cms/issues/19Exploit, Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.