CVE-2026-11473

Name of the Vulnerable Software and Affected Versions jflyfox jfinal cms versions prior to 5.1.1

Description A remote SQL injection exists in the list() function within the AdvicefeedbackController.java file. The issue occurs when the orderBy parameter is manipulated, allowing an attacker to execute arbitrary SQL commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict or sanitize the input for the orderBy parameter in the affected function to minimize the risk of exploitation.