Cross-site Scripting in JFinalcms

MEDIUM 5.4CVE-2023-50137 · GHSA-xv7p-jw46-8r85 · Published 14/12/2023 · updated 17/06/2026

In short

CVE-2023-50137 is a MEDIUM (CVSS 5.4) vulnerability affecting com.jfinal:jfinal, jfinalcms (jfinalcms project).
Chance of exploitation in the next 30 days (EPSS): 0.46%, higher than 39.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
com.jfinal:jfinal Maven	`≤ 5.0.0`	No fix yet
jfinalcms jfinalcms_project	`= 5.0.0`	No fix yet

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.

NVD description

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

≤ 5.0.0

No fix yet

= 5.0.0

No fix yet

More vulnerabilities in com.jfinal:jfinal

See all →