Cross-site Scripting in JFinal

MEDIUM 5.4CVE-2024-22493 · GHSA-3j4x-9q9q-3277 · Published 12/01/2024 · updated 17/06/2026

In short

CVE-2024-22493 is a MEDIUM (CVSS 5.4) vulnerability affecting com.jfinal:jfinal, jfinalcms (jfinalcms project).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
com.jfinal:jfinal Maven	`≤ 5.0.0`	No fix yet
jfinalcms jfinalcms_project	`= 5.0.0`	No fix yet

Description

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.

NVD description

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.

References

nvd.nist.gov/vuln/detail/CVE-2024-22493 · ADVISORY
cui2shark/security · WEB

More vulnerabilities in com.jfinal:jfinal

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.jfinal:jfinal

Maven

≤ 5.0.0

No fix yet

jfinalcms

jfinalcms_project

= 5.0.0

No fix yet

Description

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.

NVD description

A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML.

More vulnerabilities in com.jfinal:jfinal

See all →