CVE-2021-40639

HIGH 7.5CVE-2021-40639 · Published 15/09/2021 · updated 09/07/2026

In short

CVE-2021-40639 is a HIGH (CVSS 7.5) vulnerability affecting jfinal cms (jflyfox).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
jfinal cms jflyfox	`= 5.1.0`	No fix yet

Description

Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.

References

jflyfox/jfinal_cms · Product
jflyfox/jfinal_cms · Exploit

More vulnerabilities in jfinal cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free