Overview 18 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
18matches
1in Waratek scope5.6%
1protected5.6%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
5.6%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
17
94.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
5.6%
partly blocked
0
0.0%
not blocked
17
94.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
6
33.3%
Forecast only
0
0.0%
No public exploit
12
66.7%
split by
peak 5 / year
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20150
20160
20171
Not applicable1
High1
not blocked1
No public exploit1
20183
Not applicable3
High2
Medium1
not blocked3
No public exploit3
20190
20200
20210
20221
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20235
Not applicable5
Critical1
High1
Medium3
not blocked5
Proof of concept only1
No public exploit4
20243
Not applicable3
High1
Medium2
not blocked3
Proof of concept only1
No public exploit2
20254
Not applicable4
Critical1
High1
Medium1
Low1
not blocked4
Proof of concept only4
201420152016201720182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-10098 | Low | 2025-05-15 | Not applicable | Proof of concept only | The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain |
| CVE-2024-48907 | High | 2025-05-01 | Not applicable | Proof of concept only | Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API. |
| CVE-2024-48906 | Medium | 2025-05-01 | Not applicable | Proof of concept only | Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name. |
| CVE-2024-48905 | Critical | 2025-05-01 | Not applicable | Proof of concept only | Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint. |
| CVE-2024-44085 | Medium | 2024-09-09 | Not applicable | Proof of concept only | ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883. |
| CVE-2024-7870 | High | 2024-09-04 | Not applicable | No public exploit | The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files. |
| CVE-2024-37447 | Medium | 2024-07-21 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 9.6.1.1. |
| CVE-2023-45756 | High | 2023-10-25 | Not applicable | No public exploit | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline – Application Form Builder and Manager plugin <= 2.5.2 versions. |
| CVE-2023-24391 | Medium | 2023-08-10 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline plugin <= 2.5 versions. |
| CVE-2023-34939 | Critical | 2023-06-22 | Not applicable | Proof of concept only | Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx. |
| CVE-2023-2584 | Medium | 2023-06-09 | Not applicable | No public exploit | The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
| CVE-2023-22700 | Medium | 2023-03-13 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions. |
| CVE-2021-41042 | Medium | 2022-07-07 | Protected by Waratek | No public exploit | In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved. |
| CVE-2017-17172 | High | 2018-06-14 | Not applicable | No public exploit | Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability. An authenticated, local attacker can crafts malformed packets after tricking a user to install a malicious application and exploit this vulnerability when in the exception handling process. Successful exploitation may cause the attacker to obtain a higher privilege of the smart phones. |
| CVE-2017-16110 | High | 2018-06-07 | Not applicable | No public exploit | weather.swlyons is a simple web server for weather updates. weather.swlyons is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
| CVE-2018-0578 | Medium | 2018-05-14 | Not applicable | No public exploit | Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2017-2699 | High | 2017-11-22 | Not applicable | No public exploit | The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of arbitrary code. |
| CVE-2014-3750 | Medium | 2014-05-16 | Not applicable | No public exploit | The Bilyoner application before 2.3.1 for Android and before 4.6.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |