A vulnerability has been discovered in the 5.0.0 release of heyewei JFinalCMS. When an attacker submits a crafted payload to the /admin/admin/save API endpoint, the system stores the input without proper sanitization, allowing arbitrary JavaScript to be embedded. When that stored content is later rendered in the web application, the injected script runs in the victim’s browser, enabling session hijacking, data theft, or site defacement. The flaw is a stored cross‑site scripting (XSS) condition covered by CWE‑79 and CWE‑94.

Systems running the heyewei JFinalCMS 5.0.0 component are affected. The vulnerability is linked to the /admin/admin/save endpoint of the CMS administration area. No other product versions are listed as impacted in the available data.

The base CVSS score of 4.8 indicates a moderate risk rating. The EPSS score is reported as less than 1 percent, implying that exploitation is unlikely at this time, and the vulnerability is not included in the CISA KEV catalog. Attackers can initiate the exploit remotely by sending a malicious request to the admin interface; however, the ability to trigger the stored script depends on successful data persistence and subsequent page rendering. Because the flaw resides in an administrative endpoint, it is likely that an attacker would need access to an active admin session to inject the payload, but this is inferred from the description.