{"id":"CVE-2023-30349","aliases":["EUVD-2023-1242","GHSA-8qhm-ch8h-xgjr"],"status":"published","title":"Remote code execution in JFinal CMS","description":"JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01562,"percentile":0.75579,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2023-04-27T00:00:00Z","modified":"2026-10-28T02:30:55Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.jflyfox:jflyfox_jfinal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.1.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.jflyfox:jflyfox_jfinal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.1.0"}]}],"versions":["1.8","1.9","2.0","2.1","3.0","4.0","4.1","4.2","4.3","4.4","4.5.0"]}],"products":[{"vendor":"jflyfox","product":"jfinal_cms"}],"references":[{"url":"https://github.com/jflyfox/jfinal_cms/issues/54","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30349","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8qhm-ch8h-xgjr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30349.json","tags":["advisory"]},{"url":"https://github.com/jflyfox/jflyfox_jfinal","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-30349","description":"JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.","status":"published","published":"2023-04-27T00:00:00Z","modified":"2025-01-31T18:27:40.869Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2023-1242","description":"JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.","status":"published","published":"2023-04-27T00:00:00Z","modified":"2025-01-31T18:27:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:07.748787Z"}],"ghsa":[{"id":"GHSA-8qhm-ch8h-xgjr","title":"Remote code execution in JFinal CMS","description":"JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.","status":"published","published":"2023-04-27T15:30:44Z","modified":"2023-11-07T05:06:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:37:15.931647Z"}],"nvd":[{"id":"CVE-2023-30349","description":"JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.","status":"published","published":"2023-04-27T14:15:09.32Z","modified":"2026-06-17T05:54:31.45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:59.151142Z"}],"osv":[{"id":"CVE-2023-30349","description":"JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.","status":"published","published":"2023-04-27T00:00:00Z","modified":"2026-10-28T02:30:55.985461668Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"GHSA-8qhm-ch8h-xgjr","title":"Remote code execution in JFinal CMS","description":"JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.","status":"published","published":"2023-04-27T15:30:44Z","modified":"2024-11-28T05:39:20.423936Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}