Kaoniniang2

**Name of the Vulnerable Software and Affected Versions** cool-admin-java version 1.0 **Description** An arbitrary file upload vulnerability in the component /comm/upload allows attackers to execute arbitrary code via uploading a crafted file. This issue enables attackers to upload malicious files, potentially leading to code execution. **Recommendations** For cool-admin-java version 1.0, consider disabling the /comm/upload component until a patch is available to prevent exploitation. Restrict access to this component to minimize the risk of arbitrary code execution. Avoid using this component for file uploads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cool-admin-java version v1.0 **Description** A stored cross-site scripting (XSS) vulnerability in the Parameter List module of cool-admin-java allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the internet pictures field. **Recommendations** For cool-admin-java version v1.0, consider disabling the Parameter List module until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the internet pictures field to minimize the risk of arbitrary script execution.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue concerns the unauthorized execution of deserialization in the ApiForm.java file, leading to command execution. **Recommendations** For JFinal CMS version 5.1.0, consider disabling the deserialization functionality in the ApiForm.java file as a temporary workaround until a patch is available. Restrict access to the ApiForm.java file to minimize the risk of exploitation. Avoid using the deserialization feature in the affected version until the issue is resolved.