CVE-2024-57768: Jfinaloa Project Jfinaloa

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key.

Affected products

• Jfinaloa Project Jfinaloa: before 2025-01-01 (fixed in 2025-01-01)

Published 2025-01-16. Last modified 2026-06-17.