GHSA-859h-4w58-78xw

Cross-site Scripting in JFinal

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-22492

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.jfinal:jfinal	<= 5.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-22492 advisory
https://github.com/cui2shark/security/blob/main/%28JFinalcms%20contact%20para%29A%20stored%20cross-site%20scripting%20%28XSS%29%20vulnerabil… web