Overview 11 matches · 3 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
11matches
3in Waratek scope27.3%
0protected0.0%
1exploited9.1%
1CISA KEV9.1%
1public PoC9.1%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
27.3%
Outside Waratek scope
0
0.0%
Not applicable
8
72.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
11
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
9.1%
Working exploit published
0
0.0%
Proof of concept only
5
45.5%
Forecast only
0
0.0%
No public exploit
5
45.5%
split by
peak 3 / year
20202
Not applicable2
Critical2
not blocked2
No public exploit2
20210
20221
Not applicable1
Critical1
not blocked1
No public exploit1
20231
Not applicable1
Critical1
not blocked1
Proof of concept only1
20243
No exploit published3
Critical3
not blocked3
Proof of concept only3
20253
Not applicable3
Critical3
not blocked3
Proof of concept only1
No public exploit2
20261
Not applicable1
Critical1
not blocked1
Exploited1
2020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-86218 | Critical | 2026-09-06 | Not applicable | Exploited | N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. |
| CVE-2015-2079 | Critical | 2025-04-28 | Not applicable | Proof of concept only | Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open. |
| CVE-2025-30091 | Critical | 2025-03-25 | Not applicable | No public exploit | In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed. |
| CVE-2024-13264 | Critical | 2025-01-09 | Not applicable | No public exploit | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2. |
| CVE-2024-55877 | Critical | 2024-12-12 | No exploit published | Proof of concept only | XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround. |
| CVE-2024-55662 | Critical | 2024-12-12 | No exploit published | Proof of concept only | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page `ExtensionCode.ExtensionSheet` and to the page `ExtensionCode.ExtensionAuthorsDisplayer`. |
| CVE-2024-43400 | Critical | 2024-08-19 | No exploit published | Proof of concept only | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. |
| CVE-2023-39726 | Critical | 2023-10-26 | Not applicable | Proof of concept only | An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal. |
| CVE-2022-0895 | Critical | 2022-03-10 | Not applicable | No public exploit | Static Code Injection in GitHub repository microweber/microweber prior to 1.3. |
| CVE-2020-6144 | Critical | 2020-09-01 | Not applicable | No public exploit | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2020-6143 | Critical | 2020-09-01 | Not applicable | No public exploit | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability. |