PT-2026-47205 · Jflyfox · Jfinalcms

0Xrry · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-11473

NVD

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A vulnerability was identified in jflyfox jfinal cms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-11473

Affected Products

Jfinalcms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-11473 · Security Note
• https://vuldb.com/submit/833907 · Note
• https://github.com/jflyfox/jfinal_cms · Note
• https://vuldb.com/cve/CVE-2026-11473 · Note
• https://github.com/jflyfox/jfinal_cms/issues/62 · Note
• https://vuldb.com/vuln/369093 · Note
• https://vuldb.com/vuln/369093/cti · Note