com.jfinal:jfinal@4.9.06 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the com.jfinal:jfinal package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
H Arbitrary Code Execution com.jfinal:jfinal is a JFinal is a simple, light, rapid,independent, extensible Java WEB + ORM framework. The feature of JFinal looks like ruby on rails especially ActiveRecord. Affected versions of this package are vulnerable to Arbitrary Code Execution via the `template` function. How to fix Arbitrary Code Execution? There is no fixed version for `com.jfinal:jfinal`.	[0,)
C Deserialization of Untrusted Data com.jfinal:jfinal is a JFinal is a simple, light, rapid,independent, extensible Java WEB + ORM framework. The feature of JFinal looks like ruby on rails especially ActiveRecord. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A deserialization vulnerability exists when using redis, which may lead to code execution. How to fix Deserialization of Untrusted Data? Upgrade `com.jfinal:jfinal` to version 5.2.1 or higher.	[,5.2.1)
M Cross-site Scripting (XSS) com.jfinal:jfinal is a JFinal is a simple, light, rapid,independent, extensible Java WEB + ORM framework. The feature of JFinal looks like ruby on rails especially ActiveRecord. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The `set` method of the `Controller` class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases. How to fix Cross-site Scripting (XSS)? There is no fixed version for `com.jfinal:jfinal`.	[0,)