CVE-2024-5379: JFinalCMS template cross site scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-05-26 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266291.

Affected products

JFinalCMS: before 20240111 — fixed in 20240111

How to fix

Upgrade to a fixed version: JFinalCMS 20240111. Check the vendor advisory for mitigations.

References

https://gitee.com/heyewei/JFinalcms/issues/I8VHGR
https://vuldb.com/?ctiid.266291
https://vuldb.com/?id.266291
https://gitee.com/heyewei/JFinalcms/issues/I8VHGR
https://vuldb.com/?ctiid.266291
https://vuldb.com/?id.266291

Get alerted when CVE-2024-5379 or the next vulnerability affects your stack