CVE-2026-11473
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In jfinal_cms up to version 5.1.0, an SQL injection vulnerability was found in the list function of AdvicefeedbackController.java. Manipulating the orderBy argument allows remote attack. The project was notified but has not responded.
Risk Assessment
An attacker can remotely execute SQL queries, potentially leading to unauthorized data access.
Recommendation
Temporarily disable the list function or apply custom security measures until a patch is released.
Other vulnerabilities in jfinal_cms
See allOriginal NVD description (English source)
A vulnerability was identified in jflyfox jfinal_cms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.