WaratekVRT Sign in
Reset
More filters (2)
Columns
CWE CWE-89✕Has a public PoC✕
Overview 13 matches · 8 protected · 7 exploited · 0 CISA KEV · 6 EPSS ≥ 0.5
13matches 8protected61.5% 7exploited53.8% 0CISA KEV0.0% 6EPSS ≥ 0.546.2%
Protected by Waratek 8 61.5% Rule in development 0 0.0% Mitigation candidate 5 38.5% No exploit published 0 0.0%
Critical 9 69.2% High 3 23.1% Medium 1 7.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 8 61.5% partly blocked 0 0.0% not blocked 5 38.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 53.8% Working exploit published 4 30.8% Proof of concept only 2 15.4% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Mitigation candidate: 5Protected by Waratek: 8 Medium: 1High: 3Critical: 9 not blocked: 5blocked by ARMR today: 8 Proof of concept only: 2Working exploit published: 4Exploited: 7
20132 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 Working exploit published2 20140 20150 20161 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20180 20190 20200 20211 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 20221 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 20231 Mitigation candidate1 Critical1 not blocked1 Exploited1 20241 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20254 Protected by Waratek1 Mitigation candidate3 Critical4 blocked by ARMR today1 not blocked3 Exploited4 20261 Mitigation candidate1 Critical1 not blocked1 Exploited1
2014201620182020202220242026
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-76904 Critical 2026-08-21 Mitigation candidate Exploited GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
CVE-2025-52472 Critical 2025-10-06 Mitigation candidate Exploited XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.
CVE-2025-32429 Critical 2025-07-24 Mitigation candidate Exploited XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.
CVE-2025-32969 Critical 2025-04-23 Mitigation candidate Exploited XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.
CVE-2025-29085 Critical 2025-04-02 Protected by Waratek Exploited SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.
CVE-2024-5276 Critical 2024-06-25 Protected by Waratek Exploited A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.
CVE-2023-25157 Critical 2023-02-21 Mitigation candidate Exploited GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.
CVE-2022-23305 Critical 2022-01-18 Protected by Waratek Proof of concept only By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-21380 High 2021-03-23 Protected by Waratek Proof of concept only XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. The problem has been patched in XWiki 12.9RC1. The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.
CVE-2017-3549 Critical 2017-04-24 Protected by Waratek Working exploit published Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2016-0710 High 2016-04-11 Protected by Waratek Working exploit published Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
CVE-2013-4882 Medium 2013-07-22 Protected by Waratek Working exploit published Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.
CVE-2013-0140 High 2013-05-01 Protected by Waratek Working exploit published SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.