WaratekVRT Sign in

High Jspwiki CVEs

4 CVEs, 1 protected by Waratek

Reset
More filters (1)
Columns
Product jspwiki✕
Overview 4 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
4matches 1protected25.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 75.0%
Critical 0 0.0% High 4 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 25.0% partly blocked 0 0.0% not blocked 3 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 4 100.0%
split by peak 2 / year
No exploit published: 3Protected by Waratek: 1 High: 4 not blocked: 3blocked by ARMR today: 1 No public exploit: 4
20191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20200 20210 20222 No exploit published2 High2 not blocked2 No public exploit2 20230 20240 20251 No exploit published1 High1 not blocked1 No public exploit1
2019202020212022202320242025
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-24853 High 2025-07-31 No exploit published No public exploit A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too. Apache JSPWiki users should upgrade to 2.12.3 or later.
CVE-2022-34158 High 2022-08-04 No exploit published No public exploit A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.
CVE-2022-24947 High 2022-02-25 No exploit published No public exploit Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
CVE-2019-0225 High 2019-03-28 Protected by Waratek No public exploit A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.