Overview 18 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
18matches
0in Waratek scope0.0%
0protected0.0%
2exploited11.1%
0CISA KEV0.0%
1public PoC5.6%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
18
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
18
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
2
11.1%
Working exploit published
0
0.0%
Proof of concept only
6
33.3%
Forecast only
0
0.0%
No public exploit
10
55.6%
split by
peak 5 / quarter
Q4 211
Not applicable1
Critical1
not blocked1
Exploited1
Q1 220
Q2 220
Q3 221
Not applicable1
Critical1
not blocked1
No public exploit1
Q4 220
Q1 230
Q2 233
Not applicable3
Critical3
not blocked3
No public exploit3
Q3 230
Q4 233
Not applicable3
Critical3
not blocked3
Proof of concept only1
No public exploit2
Q1 245
Not applicable5
Critical5
not blocked5
Proof of concept only3
No public exploit2
Q2 240
Q3 240
Q4 240
Q1 250
Q2 252
Not applicable2
Critical2
not blocked2
Proof of concept only1
No public exploit1
Q3 250
Q4 251
Not applicable1
Critical1
not blocked1
Proof of concept only1
Q1 260
Q2 262
Not applicable2
Critical2
not blocked2
Exploited1
No public exploit1
Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25Q2 26
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-49103 | Critical | 2026-05-27 | Not applicable | No public exploit | Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi. |
| CVE-2026-39813 | Critical | 2026-04-14 | Not applicable | Exploited | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests. |
| CVE-2025-61318 | Critical | 2025-12-08 | Not applicable | Proof of concept only | Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal. |
| CVE-2024-53636 | Critical | 2025-04-26 | Not applicable | No public exploit | An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in the filePath parameter. |
| CVE-2025-43928 | Critical | 2025-04-20 | Not applicable | Proof of concept only | In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing. |
| CVE-2024-2563 | Critical | 2024-03-17 | Not applicable | Proof of concept only | A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability. |
| CVE-2024-0989 | Critical | 2024-01-29 | Not applicable | No public exploit | A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function del_sn_db of the file /application/index/controller/Service.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-252254 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-0417 | Critical | 2024-01-11 | Not applicable | Proof of concept only | A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controller/MemberAuth.php. The manipulation of the argument member_info leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250437 was assigned to this vulnerability. |
| CVE-2024-0416 | Critical | 2024-01-11 | Not applicable | Proof of concept only | A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the file application/home/controller/MemberAuth.php. The manipulation of the argument file_name leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250436. |
| CVE-2023-6699 | Critical | 2024-01-11 | Not applicable | No public exploit | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. |
| CVE-2023-7134 | Critical | 2023-12-28 | Not applicable | Proof of concept only | A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument page leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249137 was assigned to this vulnerability. |
| CVE-2023-7058 | Critical | 2023-12-22 | Not applicable | No public exploit | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248749 was assigned to this vulnerability. |
| CVE-2023-6900 | Critical | 2023-12-17 | Not applicable | No public exploit | A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the file /settings/delete_file. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-248258 is the identifier assigned to this vulnerability. |
| CVE-2023-3057 | Critical | 2023-06-02 | Not applicable | No public exploit | A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230543. |
| CVE-2023-3056 | Critical | 2023-06-02 | Not applicable | No public exploit | A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-230542 is the identifier assigned to this vulnerability. |
| CVE-2023-1800 | Critical | 2023-04-02 | Not applicable | No public exploit | A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224768. |
| CVE-2022-38129 | Critical | 2022-08-10 | Not applicable | No public exploit | A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an unauthenticated remote attacker to upload arbitrary files to the SMS host. |
| CVE-2020-7882 | Critical | 2021-11-22 | Not applicable | Exploited | Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal characters(ie. '../../../') |