CVE-2022-36527: 
Java vulnerability analysis and mitigation

Jfinal CMS v5.1.0 contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text. The vulnerability was discovered and reported on July 18, 2022 (CVE Details, GitHub Issue).

The vulnerability exists in the blog publishing module where input validation is insufficient for the post title field. An attacker can inject malicious JavaScript code in the title field that gets stored and executed when users or administrators view the blog post. A proof-of-concept exploit demonstrates that injecting the payload 'test1" onmouseover="alert(document.cookie)' into the title field successfully triggers the XSS when users hover over the title (GitHub Issue).

When successfully exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers in the context of the vulnerable website. This could lead to cookie theft, session hijacking, or other client-side attacks against users viewing the malicious blog posts (GitHub Issue).