CVE-2021-40639
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
In Jfinal CMS 5.1.0, improper access control allows attackers to read sensitive information by directly requesting the file /classes/conf/db.properties&config=filemanager.config.js.
Risk Assessment
An attacker can obtain database configuration data, leading to leakage of confidential information and potential system takeover.
Recommendation
Immediately update Jfinal CMS to the latest version and configure proper access rules to block direct requests to configuration files.
Other vulnerabilities in Jfinal CMS
See all- CVE-2026-11473Medium
In jfinal_cms up to version 5.1.0, an SQL injection vulnerability was found in the list function of AdvicefeedbackController.java. Manipulating the orderBy argument allows remote attack. The project was notified but has not responded.
- CVE-2023-34645High
jfinal CMS version 5.1.0 has an arbitrary file read vulnerability.
Original NVD description (English source)
Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.