CVE-2023-34645
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
jfinal CMS version 5.1.0 has an arbitrary file read vulnerability.
Risk Assessment
Exploitation of this vulnerability may lead to the disclosure of sensitive data stored on the server.
Recommendation
It is recommended to upgrade to the latest version of jfinal CMS to mitigate this vulnerability.
Other vulnerabilities in jfinal CMS 5.1.0
See all- CVE-2026-11473Medium
In jfinal_cms up to version 5.1.0, an SQL injection vulnerability was found in the list function of AdvicefeedbackController.java. Manipulating the orderBy argument allows remote attack. The project was notified but has not responded.
- CVE-2021-40639High
In Jfinal CMS 5.1.0, improper access control allows attackers to read sensitive information by directly requesting the file /classes/conf/db.properties&config=filemanager.config.js.
Original NVD description (English source)
jfinal CMS 5.1.0 has an arbitrary file read vulnerability.