CVE-2022-36527: XSS vulnerability1 in jfinal_cms 5.1.0 · Issue #45 · jflyfox/jfinal_cms

There is a stored XSS vulnerability in JFinal_cms 's publish blog module. An attacker could insert malicious XSS code into the post title. When users and administrators view the blog post, the malicious XSS code is triggered successfully.

First register a user to test it, then go to the submit blog post page and insert the malicious XSS code in the subject field

Payload : test1" onmouseover="alert(document.cookie)

Successfully executed malicious XSS code: