← Back

Jfinaloa

jfinaloa

Vendor: Jfinaloa Project • 11 CVEs

CVEs (11)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-57776
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
4.6 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-57775
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid.
CVE-2024-57774
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in the getBusinessUploadListPage?busid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-57773
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-57772
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-57771
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-57770
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id.
CVE-2024-57769
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser.
CVE-2024-57768
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Jan 16, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key.
CVE-2023-0758
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Feb 9, 2023
N/A· v4
9.8 CRITICAL· v3
6.5 MEDIUM· v2
A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the a...Show more
A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220469 was assigned to this vulnerability.Show less
CVE-2021-40645
1Jfinaloa Project
1Jfinaloa
Jun 17, 2026
Mar 30, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController.