So4M

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/article/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/article/list approve" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/comment/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/contact/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/foldernotice/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/folderrollpicture/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/friendlylink/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue is related to SQL Injection, which can be exploited via the "/admin/imagealbum/list" API endpoint. This allows for potential unauthorized access to sensitive data. **Recommendations** For JFinal CMS version 5.1.0, consider restricting access to the "/admin/imagealbum/list" endpoint until a patch is available. As a temporary workaround, avoid using sensitive queries in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue is related to SQL Injection, which can be exploited via the "/admin/image/list" API endpoint. This allows for potential unauthorized access to sensitive data. **Recommendations** For JFinal CMS version 5.1.0, consider restricting access to the "/admin/image/list" endpoint until a patch is available. As a temporary workaround, review and limit the use of user-input data in SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue is related to SQL Injection, which can be exploited via the "/admin/site/list" API endpoint. This allows for potential unauthorized access to sensitive data. **Recommendations** For JFinal CMS version 5.1.0, consider restricting access to the "/admin/site/list" endpoint until a patch is available. As a temporary workaround, review and limit the use of user-input data in SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/videoalbum/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/admin/video/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue allows for SQL Injection via the "/system/department/list" API endpoint. **Recommendations** For JFinal CMS version 5.1.0, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue is related to SQL Injection, which can be exploited via the `/system/menu/list` API endpoint. This allows for potential unauthorized access to sensitive data. **Recommendations** For JFinal CMS version 5.1.0, as a temporary workaround, consider restricting access to the `/system/menu/list` API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JFinal CMS version 5.1.0 **Description** The issue is related to SQL Injection, which can be exploited via the `/system/role/list` API endpoint. This allows for potential unauthorized access to sensitive data. **Recommendations** For JFinal CMS version 5.1.0, as a temporary workaround, consider restricting access to the `/system/role/list` endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.