Vulnerabilities > Jflyfox

DATE CVE VULNERABILITY TITLE RISK
2021-09-15 CVE-2020-19150 Path Traversal vulnerability in Jflyfox Jfinal CMS
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'.
network
low complexity
jflyfox CWE-22
5.5
2021-09-15 CVE-2020-19151 Command Injection vulnerability in Jflyfox Jfinal CMS
Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'.
network
low complexity
jflyfox CWE-77
6.5
2021-09-15 CVE-2020-19154 Path Traversal vulnerability in Jflyfox Jfinal CMS
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'.
network
low complexity
jflyfox CWE-22
4.0
2021-09-15 CVE-2020-19155 Exposure of Resource to Wrong Sphere vulnerability in Jflyfox Jfinal CMS
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'.
network
low complexity
jflyfox CWE-668
8.8