WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product projects✕
Overview 40 matches · 1 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 6 public PoC · 1 EPSS ≥ 0.5
40matches 1in Waratek scope2.5% 0protected0.0% 1exploited2.5% 1CISA KEV2.5% 6public PoC15.0% 1EPSS ≥ 0.52.5%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 2.5% Outside Waratek scope 0 0.0% Not applicable 39 97.5% Withdrawn CVE 0 0.0%
Critical 7 17.5% High 11 27.5% Medium 22 55.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 40 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 2.5% Working exploit published 5 12.5% Proof of concept only 7 17.5% Forecast only 0 0.0% No public exploit 27 67.5%
split by peak 6 / year
Not applicable: 39No exploit published: 1 Medium: 22High: 11Critical: 7 not blocked: 40 No public exploit: 27Proof of concept only: 7Working exploit published: 5Exploited: 1
20011 Not applicable1 Medium1 not blocked1 No public exploit1 20020 20030 20040 20050 20060 20070 20080 20090 20101 Not applicable1 High1 not blocked1 Working exploit published1 20110 20120 20131 Not applicable1 Medium1 not blocked1 No public exploit1 20142 Not applicable2 Medium2 not blocked2 No public exploit2 20153 Not applicable3 High1 Medium2 not blocked3 Working exploit published3 20161 Not applicable1 Medium1 not blocked1 No public exploit1 20172 Not applicable2 Critical1 Medium1 not blocked2 No public exploit2 20186 Not applicable6 Critical4 Medium2 not blocked6 No public exploit6 20195 Not applicable5 High3 Medium2 not blocked5 No public exploit5 20200 20216 No exploit published1 Not applicable5 Critical1 High3 Medium2 not blocked6 No public exploit6 20221 Not applicable1 Medium1 not blocked1 Proof of concept only1 20231 Not applicable1 Medium1 not blocked1 Proof of concept only1 20243 Not applicable3 Critical1 Medium2 not blocked3 Exploited1 No public exploit2 20256 Not applicable6 High2 Medium4 not blocked6 Working exploit published1 Proof of concept only4 No public exploit1 20261 Not applicable1 High1 not blocked1 Proof of concept only1
200220052008201120142017202020232026
40 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-20253 High 2026-06-19 Not applicable Proof of concept only Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data.
CVE-2023-53980 High 2025-12-22 Not applicable Proof of concept only ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
CVE-2023-53930 High 2025-12-17 Not applicable Proof of concept only ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.
CVE-2023-53906 Medium 2025-12-17 Not applicable Proof of concept only projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection.
CVE-2023-53905 Medium 2025-12-17 Not applicable Proof of concept only ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.
CVE-2024-13115 Medium 2025-02-04 Not applicable No public exploit The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-13114 Medium 2025-02-04 Not applicable Working exploit published The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2024-11680 Critical 2024-11-26 Not applicable Exploited ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
CVE-2024-7659 Medium 2024-08-12 Not applicable No public exploit A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component.
CVE-2024-7658 Medium 2024-08-12 Not applicable No public exploit A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.
CVE-2023-0607 Medium 2023-02-01 Not applicable Proof of concept only Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.
CVE-2017-20101 Medium 2022-06-27 Not applicable Proof of concept only A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.
CVE-2021-40888 Medium 2021-10-11 Not applicable No public exploit Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code.
CVE-2021-40887 Critical 2021-10-11 Not applicable No public exploit Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.
CVE-2021-40886 Medium 2021-10-11 Not applicable No public exploit Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.
CVE-2021-40884 High 2021-10-11 Not applicable No public exploit Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application.
CVE-2021-2258 High 2021-04-22 No exploit published No public exploit Vulnerability in the Oracle Projects product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Projects. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Projects accessible data as well as unauthorized access to critical data or complete access to all Oracle Projects accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2020-28874 High 2021-01-26 Not applicable No public exploit reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
CVE-2018-7202 Medium 2019-05-22 Not applicable No public exploit An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page.
CVE-2018-7201 High 2019-05-22 Not applicable No public exploit CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
CVE-2019-11533 Medium 2019-04-26 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.
CVE-2019-11492 High 2019-04-26 Not applicable No public exploit ProjectSend before r1070 writes user passwords to the server logs.
CVE-2019-11378 High 2019-04-20 Not applicable No public exploit An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2016-10734 Critical 2018-10-29 Not applicable No public exploit ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
CVE-2016-10733 Critical 2018-10-29 Not applicable No public exploit ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
CVE-2016-10732 Critical 2018-10-29 Not applicable No public exploit ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
CVE-2016-10731 Critical 2018-10-29 Not applicable No public exploit ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.
CVE-2017-9786 Medium 2018-03-06 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php.
CVE-2017-9783 Medium 2018-03-06 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated.
CVE-2017-9741 Critical 2017-06-18 Not applicable No public exploit install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.
CVE-2016-8213 Medium 2017-01-23 Not applicable No public exploit EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; and EMC Documentum Capital Projects Version 1.9, prior to P30 and Version 1.10, prior to P17; and EMC Documentum Administrator Version 7.0, Version 7.1, and Version 7.2 prior to P18 contain a Stored Cross-Site Scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVE-2016-0914 Medium 2016-06-23 Not applicable No public exploit EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before Patch 23 and 1.10 before Patch 10, and Documentum TaskSpace 6.7 SP3 allow remote authenticated users to bypass intended access restrictions and execute arbitrary IAPI/IDQL commands via the IAPI/IDQL interface.
CVE-2015-2564 Medium 2015-03-20 Not applicable Working exploit published SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.
CVE-2014-9580 Medium 2015-01-08 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information.
CVE-2014-9567 High 2015-01-07 Not applicable Working exploit published Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.
CVE-2014-2518 Medium 2014-08-20 Not applicable No public exploit Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Documentum WDK before 6.7SP1 P28 and 6.7SP2 before P15 allow remote attackers to hijack the authentication of arbitrary users.
CVE-2014-2511 Medium 2014-08-20 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.
CVE-2013-3281 Medium 2013-11-06 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2 P07, Documentum WDK before 6.7 SP2 P07, Documentum Taskspace before 6.7 SP2 P07, Documentum Records Manager before 6.7 SP2 P07, Documentum Web Publisher before 6.5 SP7, Documentum Digital Asset Manager before 6.5 SP6, Documentum Administrator before 6.7 SP2 P07, and Documentum Capital Projects before 1.8 P01 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter in a URL.
CVE-2010-1363 High 2010-04-13 Not applicable Working exploit published SQL injection vulnerability in the JProjects (com_j-projects) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the project parameter in a projects action to index.php.
CVE-2001-1488 Medium 2001-12-31 Not applicable No public exploit Open Projects Network Internet Relay Chat (IRC) daemon u2.10.05.18 does not perform a double-reverse DNS lookup, which allows remote attackers to spoof any valid hostname on the Internet. NOTE: a followup post suggests that this is not an issue in the daemon.