CVE-2022-37204

Final CMS 5.1.0 is vulnerable to SQL Injection.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.16% chance of exploitation in the next 30 days, 65th percentile

Published

2022-09-20

Updated

2025-05-27

Proof-of-concept exploits (2)

• AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql7.md
• AgainstTheLight/CVE-2022-372040★ · 2022-09-15

References

• CVE Record
• NVD entry

Related

• CVE-2022-30929
• CVE-2022-37201
• CVE-2022-37202
• CVE-2022-37203
• CVE-2022-37205
• CVE-2022-37207