Overview 45 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
45matches
2in Waratek scope4.4%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
4.4%
Outside Waratek scope
6
13.3%
Not applicable
37
82.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
45
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
45
100.0%
split by
peak 12 / year
20071
Outside Waratek scope1
Medium1
not blocked1
No public exploit1
20080
20090
20100
20110
20120
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20143
Outside Waratek scope1
Not applicable2
Medium2
Low1
not blocked3
No public exploit3
20152
Not applicable2
Medium2
not blocked2
No public exploit2
20160
20172
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
No public exploit2
20188
No exploit published2
Not applicable6
Critical3
High2
Medium3
not blocked8
No public exploit8
20190
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20219
Outside Waratek scope3
Not applicable6
High4
Medium5
not blocked9
No public exploit9
202212
Not applicable12
Critical1
High4
Medium7
not blocked12
No public exploit12
20234
Not applicable4
High2
Medium2
not blocked4
No public exploit4
20241
Not applicable1
High1
not blocked1
No public exploit1
20251
Not applicable1
High1
not blocked1
No public exploit1
2007200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-28861 | High | 2025-03-11 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian Datepicker: from n/a through <= 0.1.0. |
| CVE-2024-24849 | High | 2024-02-21 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1. |
| CVE-2023-5432 | Medium | 2023-12-19 | Not applicable | No public exploit | The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2023-5464 | High | 2023-10-31 | Not applicable | No public exploit | The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2023-5430 | High | 2023-10-31 | Not applicable | No public exploit | The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2023-4890 | Medium | 2023-09-12 | Not applicable | No public exploit | The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2022-2144 | Medium | 2022-07-17 | Not applicable | No public exploit | The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like default_role, users_can_register via a CSRF attack |
| CVE-2022-31147 | High | 2022-07-14 | Not applicable | No public exploit | The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch. |
| CVE-2021-43306 | High | 2022-06-02 | Not applicable | No public exploit | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method |
| CVE-2022-30241 | Medium | 2022-05-04 | Not applicable | No public exploit | The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element. |
| CVE-2022-1291 | Medium | 2022-04-10 | Not applicable | No public exploit | XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers |
| CVE-2022-23395 | Medium | 2022-03-02 | Not applicable | No public exploit | jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). |
| CVE-2021-37504 | Medium | 2022-02-25 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name. |
| CVE-2022-24985 | High | 2022-02-16 | Not applicable | No public exploit | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server. |
| CVE-2022-24984 | Critical | 2022-02-16 | Not applicable | No public exploit | Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content (e.g., .phtml or .php.bak) is blocked. |
| CVE-2022-24983 | High | 2022-02-16 | Not applicable | No public exploit | Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained with CVE-2022-24984, this could lead to unauthenticated remote code execution on the underlying web server. This occurs because the Unique ID field is contained in the POST response upon submitting a form. |
| CVE-2022-24982 | Medium | 2022-02-16 | Not applicable | No public exploit | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials. |
| CVE-2022-24981 | Medium | 2022-02-16 | Not applicable | No public exploit | A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php. |
| CVE-2021-43862 | Medium | 2021-12-30 | Not applicable | No public exploit | jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visible, but an attacker can use other techniques to hide the code the victim sees. If the application uses the `execHash` option and executes code from URL, the attacker can use this URL to execute their code. The scope is limited because the javascript attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible. This issue is fixed in version 2.31.1. As a workaround, the user can use formatting that wrap whole user input and its no op. The code for this workaround is available in the GitHub Security Advisory. The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way). |
| CVE-2021-41183 | Medium | 2021-10-26 | Outside Waratek scope | No public exploit | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources. |
| CVE-2021-41182 | Medium | 2021-10-26 | Outside Waratek scope | No public exploit | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources. |
| CVE-2021-24543 | Medium | 2021-10-25 | Not applicable | No public exploit | The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue. |
| CVE-2021-34663 | Medium | 2021-08-16 | Not applicable | No public exploit | The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5. |
| CVE-2021-20087 | High | 2021-04-23 | Not applicable | No public exploit | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties into Object.prototype. |
| CVE-2021-20084 | High | 2021-04-23 | Not applicable | No public exploit | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype. |
| CVE-2021-20083 | High | 2021-04-23 | Not applicable | No public exploit | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype. |
| CVE-2021-21252 | High | 2021-01-13 | Outside Waratek scope | No public exploit | The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3. |
| CVE-2018-18405 | Medium | 2020-04-22 | Not applicable | No public exploit | jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry |
| CVE-2018-9207 | Critical | 2018-11-19 | Not applicable | No public exploit | Arbitrary file upload in jQuery Upload File <= 4.0.2 |
| CVE-2018-9208 | Critical | 2018-11-05 | Not applicable | No public exploit | Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta |
| CVE-2018-0645 | Critical | 2018-09-07 | Not applicable | No public exploit | MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors. |
| CVE-2017-16045 | High | 2018-06-04 | Not applicable | No public exploit | `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| CVE-2018-1325 | Medium | 2018-04-18 | No exploit published | No public exploit | In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display. |
| CVE-2017-15719 | Medium | 2018-03-12 | No exploit published | No public exploit | In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor. |
| CVE-2016-10707 | High | 2018-01-18 | Not applicable | No public exploit | jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit. |
| CVE-2014-6071 | Medium | 2018-01-16 | Not applicable | No public exploit | jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after. |
| CVE-2015-7943 | Medium | 2017-10-18 | Not applicable | No public exploit | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233. |
| CVE-2016-7103 | Medium | 2017-03-15 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function. |
| CVE-2015-1840 | Medium | 2015-07-26 | Not applicable | No public exploit | jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value. |
| CVE-2015-2089 | Medium | 2015-02-26 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php. |
| CVE-2012-6662 | Medium | 2014-11-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo. |
| CVE-2010-5312 | Medium | 2014-11-24 | Outside Waratek scope | No public exploit | Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option. |
| CVE-2013-4383 | Low | 2014-01-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the jQuery Countdown module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-4969 | Medium | 2013-03-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag. |
| CVE-2007-2379 | Medium | 2007-04-30 | Outside Waratek scope | No public exploit | The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking." |