CVE-2022-27111: Jflyfox Jfinal CMS

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it.

Affected products

• Jflyfox Jfinal CMS: version 5.1.0 only

Published 2022-04-11. Last modified 2026-06-17.