Plateforme
php
Composant
my_cve
Corrigé dans
5.0.1
A cross-site scripting (XSS) vulnerability has been discovered in JFinalCMS versions 5.0.0. This flaw resides within the /admin/admin/save API endpoint, allowing an attacker to inject malicious scripts into the application. Successful exploitation could lead to session hijacking or defacement. The vulnerability was publicly disclosed on 2026-02-09 and a fix is recommended.
The XSS vulnerability in JFinalCMS allows an attacker to inject arbitrary JavaScript code into the application's web pages. This code can then be executed in the context of a user's browser, potentially granting the attacker access to sensitive information such as session cookies. An attacker could use this to hijack user accounts, deface the website, or redirect users to malicious websites. Given the public availability of the exploit, the risk of exploitation is elevated, particularly for systems with unpatched JFinalCMS installations.
The vulnerability details and exploit have been publicly disclosed, indicating a higher probability of exploitation. While no active campaigns have been confirmed, the availability of a proof-of-concept increases the risk. The CVE was published on 2026-02-09. The CVSS score is 2.4 (LOW).
Administrators and users of JFinalCMS 5.0.0 are at risk. Shared hosting environments that utilize JFinalCMS are particularly vulnerable due to the potential for cross-tenant exploitation. Systems with weak input validation or output encoding are also at increased risk.
• php / web:
grep -r "<script" /var/www/jfinalcms/admin/admin/save• generic web:
curl -I http://your-jfinalcms-site.com/admin/admin/save?param=<script>alert(1)</script>disclosure
Statut de l'Exploit
EPSS
0.04% (percentile 11%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2026-2200 is to upgrade to a patched version of JFinalCMS. Until an official patch is available, implement strict input validation and output encoding on the /admin/admin/save endpoint. This includes sanitizing all user-supplied data before it is displayed on the page. Consider using a Web Application Firewall (WAF) with XSS protection rules to filter out malicious requests. Regularly review and update your CMS security configuration.
Mettre à jour JFinalCMS à une version postérieure à la 5.0.0 qui corrige la vulnérabilité de Cross-Site Scripting (XSS). Si aucune version n'est disponible, il est recommandé d'appliquer un correctif de sécurité qui filtre ou échappe les entrées utilisateur à l'endpoint /admin/admin/save pour prévenir l'injection de code malveillant.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2026-2200 is a cross-site scripting vulnerability in JFinalCMS 5.0.0 affecting the /admin/admin/save endpoint, allowing attackers to inject malicious scripts.
If you are running JFinalCMS version 5.0.0, you are potentially affected by this vulnerability. Upgrade as soon as possible.
Upgrade to a patched version of JFinalCMS. Until a patch is available, implement strict input validation and output encoding.
While no active campaigns have been confirmed, the public availability of the exploit increases the risk of exploitation.
Refer to the JFinalCMS official website or security mailing list for the latest advisory and patch information.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.