Overview 56 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 20 public PoC · 1 EPSS ≥ 0.5
56matches
1in Waratek scope1.8%
1protected1.8%
0exploited0.0%
0CISA KEV0.0%
20public PoC35.7%
1EPSS ≥ 0.51.8%
Protected by Waratek
1
1.8%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
55
98.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.8%
partly blocked
0
0.0%
not blocked
55
98.2%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 9 / year
20004
Not applicable4
High2
Medium2
not blocked4
Working exploit published1
No public exploit3
20015
Not applicable5
High4
Medium1
not blocked5
Working exploit published1
No public exploit4
20022
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20030
20040
20050
20069
Not applicable9
High3
Medium6
not blocked9
Working exploit published6
No public exploit3
20073
Not applicable3
High2
Medium1
not blocked3
Working exploit published2
No public exploit1
20082
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
20097
Not applicable7
High2
Medium5
not blocked7
Working exploit published5
No public exploit2
20101
Not applicable1
High1
not blocked1
Working exploit published1
20110
20122
Not applicable2
Medium2
not blocked2
Working exploit published2
20132
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20140
20153
Not applicable3
High2
Medium1
not blocked3
No public exploit3
20161
Protected by Waratek1
High1
blocked by ARMR today1
Forecast only1
20170
20182
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20190
20200
20211
Not applicable1
High1
not blocked1
No public exploit1
20226
Not applicable6
High4
Medium1
Low1
not blocked6
No public exploit6
20230
20244
Not applicable4
High3
Medium1
not blocked4
No public exploit4
20252
Not applicable2
High1
Low1
not blocked2
Proof of concept only1
No public exploit1
200120042007201020132016201920222025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-9826 | High | 2025-09-15 | Not applicable | No public exploit | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. |
| CVE-2025-8751 | Low | 2025-08-09 | Not applicable | Proof of concept only | A vulnerability was found in Protected Total WebShield Extension up to 3.2.0 on Chrome. It has been classified as problematic. This affects an unknown part of the component Block Page. The manipulation of the argument Category leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-9174 | Medium | 2024-10-02 | Not applicable | No public exploit | Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI |
| CVE-2024-6881 | High | 2024-07-29 | Not applicable | No public exploit | Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session |
| CVE-2024-6124 | High | 2024-07-29 | Not applicable | No public exploit | Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session |
| CVE-2024-5142 | High | 2024-05-24 | Not applicable | No public exploit | Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser |
| CVE-2022-39019 | High | 2022-10-31 | Not applicable | No public exploit | Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server. |
| CVE-2022-39018 | High | 2022-10-31 | Not applicable | No public exploit | Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. |
| CVE-2022-39017 | High | 2022-10-31 | Not applicable | No public exploit | Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments. |
| CVE-2022-39016 | High | 2022-10-31 | Not applicable | No public exploit | Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. |
| CVE-2022-1686 | Low | 2022-06-08 | Not applicable | No public exploit | The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection |
| CVE-2022-1685 | Medium | 2022-06-08 | Not applicable | No public exploit | The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection |
| CVE-2020-19047 | High | 2021-08-31 | Not applicable | No public exploit | Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?controller=system&action=admin_edit_act'. |
| CVE-2012-6668 | Medium | 2018-01-11 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the (1) reportreason parameter in actions/doreport.php or (2) modnotes parameter in actions/updatereport.php. |
| CVE-2012-6667 | Medium | 2018-01-11 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web script or HTML via the shout parameter in a shout action. |
| CVE-2016-2510 | High | 2016-04-07 | Protected by Waratek | Forecast only | BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler. |
| CVE-2015-2244 | Medium | 2015-03-09 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Webshop hun 1.062S allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) center, (3) lap, (4) termid, or (5) nyelv_id parameter to index.php. |
| CVE-2015-2243 | High | 2015-03-09 | Not applicable | No public exploit | Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php. |
| CVE-2015-2242 | High | 2015-03-09 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in Webshop hun 1.062S allow remote attackers to execute arbitrary SQL commands via the (1) termid or (2) nyelv_id parameter to index.php. |
| CVE-2013-1898 | High | 2013-04-09 | Not applicable | No public exploit | lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. |
| CVE-2013-0465 | Medium | 2013-02-22 | Not applicable | No public exploit | Unspecified vulnerability in the IBM WebSphere Cast Iron physical and virtual appliance 6.0 and 6.1 before 6.1.0.15 and 6.3 before 6.3.0.1, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors. |
| CVE-2011-5186 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject arbitrary web script or HTML via the item_id parameter. |
| CVE-2011-5147 | Medium | 2012-08-31 | Not applicable | Working exploit published | Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as demonstrated by a call to ajax_file_cut.php and then to ajax_save_name.php. |
| CVE-2010-2031 | High | 2010-05-24 | Not applicable | Working exploit published | KAVSafe.sys 2010.4.14.609 and earlier, as used in Kingsoft Webshield 3.5.1.2 and earlier, allows local users to overwrite arbitrary kernel memory via a crafted request to IOCTL 0x830020d4 on the KAVSafe device. |
| CVE-2009-3284 | Medium | 2009-09-22 | Not applicable | No public exploit | Directory traversal vulnerability in phpspot PHP BBS, PHP Image Capture BBS, PHP & CSS BBS, PHP BBS CE, PHP_RSS_Builder, and webshot, dated before 20090914, allows remote attackers to read arbitrary files via unspecified vectors. |
| CVE-2009-3283 | Medium | 2009-09-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in phpspot PHP BBS, PHP Image Capture BBS, PHP & CSS BBS, PHP BBS CE, PHP_RSS_Builder, and webshot, dated before 20090914, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to cookies. |
| CVE-2009-2338 | Medium | 2009-07-07 | Not applicable | Working exploit published | Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_file parameter. |
| CVE-2008-6629 | Medium | 2009-04-06 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary web script or HTML via the name parameter. |
| CVE-2008-6627 | High | 2009-04-06 | Not applicable | Working exploit published | SQL injection vulnerability in getin.php in WEBBDOMAIN WebShop 1.2, 1.1, 1.02, and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. |
| CVE-2008-6268 | High | 2009-02-25 | Not applicable | Working exploit published | SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2008-6267 | Medium | 2009-02-25 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in detail.php in Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary web script or HTML via the name parameter. |
| CVE-2008-1541 | Medium | 2008-03-28 | Not applicable | Working exploit published | Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter. |
| CVE-2007-6711 | High | 2008-03-24 | Not applicable | No public exploit | Unspecified vulnerability in customer.php in FreeWebshop.org 2.2.5, 2.2.6 and 2.2.7WIP1/2 allows remote attackers to gain administrator privileges via unknown vectors. |
| CVE-2007-6466 | High | 2007-12-20 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected. |
| CVE-2007-0531 | High | 2007-01-26 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in includes/login.php in FreeWebShop 2.2.3 and 2.2.4 before 20070123 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter. |
| CVE-2006-6941 | Medium | 2007-01-19 | Not applicable | Working exploit published | index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an info operation, which discloses the path in an error message. |
| CVE-2006-5847 | Medium | 2006-11-10 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter. |
| CVE-2006-5846 | Medium | 2006-11-10 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to read and include arbitrary files via a .. (dot dot) in the page parameter, a different vector than CVE-2006-5773. |
| CVE-2006-5773 | Medium | 2006-11-06 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrary files and disclose the installation path via a .. (dot dot) in the action parameter. |
| CVE-2006-5772 | High | 2006-11-06 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) password and (2) prod parameter. |
| CVE-2006-4945 | Medium | 2006-09-23 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in Cardway (aka Frederic Boudaud) DigitalWebShop 1.128 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the _PHPLIB[libdir] parameter to (1) rechnung.php or (2) prepend.php. |
| CVE-2006-1687 | Medium | 2006-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to inject arbitrary web script or HTML via the message parameter, probably involving the basket functionality. |
| CVE-2006-1686 | Medium | 2006-04-11 | Not applicable | No public exploit | Unspecified vulnerability in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to access unspecified files via a modified warp parameter. |
| CVE-2006-1685 | High | 2006-04-11 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allow remote attackers to execute arbitrary SQL commands via the (1) group, (2) seite, and (3) id parameter, possibly involving the artikel functionality. NOTE: this vulnerability also allows resultant path disclosure when the SQL queries are invalid. |
| CVE-2006-0559 | High | 2006-04-04 | Not applicable | No public exploit | Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed. |
| CVE-2002-2293 | Medium | 2002-12-31 | Not applicable | No public exploit | Webshots Desktop screensaver allows local users to bypass the password on the screensaver by pressing CTRL-ALT-DELETE and (1) hitting the cancel button or (2) killing the screensaver from the task manager. |
| CVE-2002-1121 | High | 2002-09-24 | Not applicable | No public exploit | SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3) the default configuration of MIMEDefang before 2.21, and possibly other products, do not detect fragmented emails as defined in RFC2046 ("Message Fragmentation and Reassembly") and supported in such products as Outlook Express, which allows remote attackers to bypass content filtering, including virus checking, via fragmented emails of the message/partial content type. |
| CVE-2001-1542 | High | 2001-12-31 | Not applicable | No public exploit | NAI WebShield SMTP 4.5 and possibly 4.5 MR1a does not filter improperly MIME encoded email attachments, which could allow remote attackers to bypass filtering and possibly execute arbitrary code in email clients that process the invalid attachments. |
| CVE-2001-1456 | High | 2001-09-04 | Not applicable | No public exploit | Buffer overflow in the (1) smap/smapd and (2) CSMAP daemons for Gauntlet Firewall 5.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted mail message. |
| CVE-2001-1229 | High | 2001-03-12 | Not applicable | No public exploit | Buffer overflows in (1) Icecast before 1.3.9 and (2) libshout before 1.0.4 allow remote attackers to cause a denial of service (crash) and execute arbitrary code. |
| CVE-2000-1130 | High | 2001-01-09 | Not applicable | No public exploit | McAfee WebShield SMTP 4.5 allows remote attackers to bypass email content filtering rules by including Extended ASCII characters in name of the attachment. |
| CVE-2000-1129 | Medium | 2001-01-09 | Not applicable | Working exploit published | McAfee WebShield SMTP 4.5 allows remote attackers to cause a denial of service via a malformed recipient field. |
| CVE-2000-0738 | Medium | 2000-10-20 | Not applicable | No public exploit | WebShield SMTP 4.5 allows remote attackers to cause a denial of service by sending e-mail with a From: address that has a . (period) at the end, which causes WebShield to continuously send itself copies of the e-mail. |
| CVE-2000-0437 | High | 2000-05-18 | Not applicable | Working exploit published | Buffer overflow in the CyberPatrol daemon "cyberdaemon" used in gauntlet and WebShield allows remote attackers to cause a denial of service or execute arbitrary commands. |
| CVE-2000-0448 | Medium | 2000-05-01 | Not applicable | No public exploit | The WebShield SMTP Management Tool version 4.5.44 does not properly restrict access to the management port when an IP address does not resolve to a hostname, which allows remote attackers to access the configuration via the GET_CONFIG command. |
| CVE-2000-0447 | High | 2000-05-01 | Not applicable | No public exploit | Buffer overflow in WebShield SMTP 4.5.44 allows remote attackers to execute arbitrary commands via a long configuration parameter to the WebShield remote management service. |