WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕CWE CWE-552✕Has a public PoC✕
Overview 39 matches · 2 in Waratek scope · 1 protected · 11 exploited · 4 CISA KEV · 9 EPSS ≥ 0.5
39matches 2in Waratek scope5.1% 1protected2.6% 11exploited28.2% 4CISA KEV10.3% 9EPSS ≥ 0.523.1%
Protected by Waratek 1 2.6% Rule in development 0 0.0% Mitigation candidate 1 2.6% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 37 94.9% Withdrawn CVE 0 0.0%
Critical 7 17.9% High 23 59.0% Medium 9 23.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 2.6% partly blocked 0 0.0% not blocked 38 97.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 11 28.2% Working exploit published 22 56.4% Proof of concept only 6 15.4% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 9 / year
Not applicable: 37Mitigation candidate: 1Protected by Waratek: 1 Medium: 9High: 23Critical: 7 not blocked: 38blocked by ARMR today: 1 Proof of concept only: 6Working exploit published: 22Exploited: 11
20091 Not applicable1 Medium1 not blocked1 Working exploit published1 20100 20110 20120 20130 20140 20150 20161 Not applicable1 Medium1 not blocked1 Exploited1 20171 Not applicable1 Critical1 not blocked1 Working exploit published1 20181 Not applicable1 High1 not blocked1 Working exploit published1 20191 Not applicable1 High1 not blocked1 Proof of concept only1 20202 Not applicable2 Critical1 High1 not blocked2 Working exploit published1 Proof of concept only1 20214 Protected by Waratek1 Not applicable3 Critical1 High3 blocked by ARMR today1 not blocked3 Exploited2 Working exploit published1 Proof of concept only1 20228 Not applicable8 High5 Medium3 not blocked8 Exploited2 Working exploit published6 20239 Mitigation candidate1 Not applicable8 Critical1 High6 Medium2 not blocked9 Exploited3 Working exploit published3 Proof of concept only3 20244 Not applicable4 Critical1 High3 not blocked4 Exploited1 Working exploit published3 20254 Not applicable4 Critical1 High2 Medium1 not blocked4 Exploited1 Working exploit published3 20263 Not applicable3 Critical1 High1 Medium1 not blocked3 Exploited1 Working exploit published2
201020122014201620182020202220242026
39 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-21589 Critical 2026-10-05 Not applicable Exploited This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
CVE-2026-29066 Medium 2026-03-12 Not applicable Working exploit published Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.
CVE-2026-25231 High 2026-02-09 Not applicable Working exploit published FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or can guess the file path, without requiring authentication. As a result, sensitive data could be exposed, and privacy may be breached. This vulnerability is fixed in 3.3.0.
CVE-2025-68109 Critical 2025-12-17 Not applicable Working exploit published ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.
CVE-2021-4463 High 2025-11-12 Not applicable Working exploit published Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.
CVE-2025-11371 High 2025-10-09 Not applicable Exploited In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
CVE-2024-13126 Medium 2025-03-16 Not applicable Working exploit published The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
CVE-2024-6911 High 2024-07-22 Not applicable Working exploit published Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus: through 1.11.6507.0.
CVE-2024-6209 Critical 2024-07-05 Not applicable Working exploit published Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized
CVE-2024-4836 High 2024-07-02 Not applicable Working exploit published Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.
CVE-2023-6266 High 2024-01-11 Not applicable Exploited The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.
CVE-2023-6114 High 2023-12-26 Not applicable Exploited The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
CVE-2023-50164 Critical 2023-12-07 Mitigation candidate Exploited An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
CVE-2023-41717 Medium 2023-08-31 Not applicable Proof of concept only Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions.
CVE-2023-38952 High 2023-08-03 Not applicable Exploited Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.
CVE-2023-34834 Medium 2023-06-29 Not applicable Working exploit published A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.
CVE-2023-36664 High 2023-06-25 Not applicable Proof of concept only Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
CVE-2023-33568 High 2023-06-13 Not applicable Working exploit published An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
CVE-2023-2766 High 2023-05-17 Not applicable Working exploit published A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229271. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-22974 High 2023-02-22 Not applicable Proof of concept only A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.
CVE-2022-44356 High 2022-11-29 Not applicable Working exploit published WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.
CVE-2022-33901 High 2022-07-22 Not applicable Working exploit published Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
CVE-2022-34049 Medium 2022-07-20 Not applicable Working exploit published An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data.
CVE-2021-40150 High 2022-07-17 Not applicable Working exploit published The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI.
CVE-2021-40149 Medium 2022-07-17 Not applicable Working exploit published The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. In this way an attacker can download the entire key via the /self.key URI.
CVE-2022-0656 High 2022-04-25 Not applicable Exploited The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
CVE-2022-26271 High 2022-03-28 Not applicable Working exploit published 74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.
CVE-2022-25497 Medium 2022-03-15 Not applicable Exploited CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
CVE-2021-22015 High 2021-09-23 Not applicable Working exploit published The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
CVE-2021-25741 High 2021-09-20 Not applicable Proof of concept only A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
CVE-2021-39316 High 2021-08-31 Not applicable Exploited The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.
CVE-2020-17519 Critical 2021-01-05 Protected by Waratek Exploited A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
CVE-2020-15175 Critical 2020-10-07 Not applicable Proof of concept only In GLPI before version 9.5.2, the `​pluginimage.send.php​` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.
CVE-2020-24312 High 2020-08-26 Not applicable Working exploit published mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken.
CVE-2019-17221 High 2019-11-05 Not applicable Proof of concept only PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed.
CVE-2018-16946 High 2018-09-12 Not applicable Working exploit published LG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) files and download backup files (via download.php) without authenticating. These backup files contain user credentials and configuration information for the camera device. An attacker is able to discover the backup filename via reading the system logs or report data, or just by brute-forcing the backup filename pattern. It may be possible to authenticate to the admin account with the admin password.
CVE-2017-14942 Critical 2017-09-30 Not applicable Working exploit published Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie.
CVE-2016-3715 Medium 2016-05-05 Not applicable Exploited The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2009-3597 Medium 2009-10-08 Not applicable Working exploit published Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd.