Overview 1,337 matches · 67 in Waratek scope · 19 protected · 0 exploited · 0 CISA KEV · 181 EPSS ≥ 0.5
Protected by Waratek
19
1.4%
Rule in development
0
0.0%
Mitigation candidate
48
3.6%
No exploit published
0
0.0%
Outside Waratek scope
45
3.4%
Not applicable
1,225
91.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
19
1.4%
partly blocked
0
0.0%
not blocked
1,318
98.6%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1,337
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 113 / year
19962
Not applicable2
High2
not blocked2
Working exploit published2
19972
Not applicable2
Medium2
not blocked2
Working exploit published2
19982
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
199915
Not applicable15
High8
Medium6
Low1
not blocked15
Working exploit published15
200026
Mitigation candidate1
Outside Waratek scope1
Not applicable24
High9
Medium14
Low3
not blocked26
Working exploit published26
200116
Mitigation candidate1
Outside Waratek scope1
Not applicable14
High7
Medium8
Low1
not blocked16
Working exploit published16
200223
Outside Waratek scope3
Not applicable20
High8
Medium15
not blocked23
Working exploit published23
200320
Not applicable20
High5
Medium14
Low1
not blocked20
Working exploit published20
200438
Mitigation candidate1
Outside Waratek scope1
Not applicable36
High21
Medium15
Low2
not blocked38
Working exploit published38
200587
Mitigation candidate1
Outside Waratek scope1
Not applicable85
High44
Medium41
Low2
not blocked87
Working exploit published87
200690
Mitigation candidate1
Outside Waratek scope3
Not applicable86
High44
Medium44
Low2
not blocked90
Working exploit published90
200787
Mitigation candidate1
Outside Waratek scope1
Not applicable85
High58
Medium28
Low1
not blocked87
Working exploit published87
200894
Mitigation candidate2
Outside Waratek scope2
Not applicable90
High58
Medium36
not blocked94
Working exploit published94
2009113
Protected by Waratek1
Mitigation candidate1
Not applicable111
High63
Medium47
Low3
blocked by ARMR today1
not blocked112
Working exploit published113
201063
Protected by Waratek2
Mitigation candidate2
Outside Waratek scope3
Not applicable56
Critical1
High35
Medium23
Low4
blocked by ARMR today2
not blocked61
Working exploit published63
201140
Mitigation candidate4
Outside Waratek scope3
Not applicable33
High23
Medium16
Low1
not blocked40
Working exploit published40
201265
Mitigation candidate7
Outside Waratek scope2
Not applicable56
High24
Medium37
Low4
not blocked65
Working exploit published65
201342
Mitigation candidate4
Outside Waratek scope2
Not applicable36
High18
Medium22
Low2
not blocked42
Working exploit published42
201454
Mitigation candidate4
Outside Waratek scope1
Not applicable49
Critical1
High24
Medium28
Low1
not blocked54
Working exploit published54
201550
Mitigation candidate4
Outside Waratek scope3
Not applicable43
High24
Medium18
Low8
not blocked50
Working exploit published50
201658
Protected by Waratek2
Mitigation candidate2
Not applicable54
Critical8
High28
Medium20
Low2
blocked by ARMR today2
not blocked56
Working exploit published58
201784
Protected by Waratek3
Mitigation candidate2
Outside Waratek scope2
Not applicable77
Critical22
High44
Medium18
blocked by ARMR today3
not blocked81
Working exploit published84
201891
Protected by Waratek1
Mitigation candidate2
Outside Waratek scope8
Not applicable80
Critical35
High34
Medium22
blocked by ARMR today1
not blocked90
Working exploit published91
201947
Protected by Waratek4
Mitigation candidate1
Outside Waratek scope4
Not applicable38
Critical6
High25
Medium16
blocked by ARMR today4
not blocked43
Working exploit published47
202030
Protected by Waratek2
Mitigation candidate1
Outside Waratek scope1
Not applicable26
Critical8
High19
Medium3
blocked by ARMR today2
not blocked28
Working exploit published30
202131
Protected by Waratek3
Mitigation candidate4
Outside Waratek scope2
Not applicable22
Critical6
High13
Medium12
blocked by ARMR today3
not blocked28
Working exploit published31
202217
Protected by Waratek1
Outside Waratek scope1
Not applicable15
Critical4
High9
Medium4
blocked by ARMR today1
not blocked16
Working exploit published17
202320
Mitigation candidate2
Not applicable18
Critical7
High6
Medium7
not blocked20
Working exploit published20
202411
Not applicable11
Critical5
High3
Medium3
not blocked11
Working exploit published11
202515
Not applicable15
Critical1
High8
Medium6
not blocked15
Working exploit published15
20264
Not applicable4
Critical2
Medium2
not blocked4
Working exploit published4
19961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-88773 | Critical | 2026-09-27 | Not applicable | Working exploit published | Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23. |
| CVE-2026-27645 | Medium | 2026-02-25 | Not applicable | Working exploit published | changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue. |
| CVE-2026-2624 | Critical | 2026-02-25 | Not applicable | Working exploit published | Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentication Bypass. This issue affects Antikor Next Generation Firewall (NGFW): from v.2.0.1298 before v.2.0.1301. |
| CVE-2026-25527 | Medium | 2026-02-19 | Not applicable | Working exploit published | changedetection.io is a free open source web page change detection tool. In versions prior to 0.53.2, the `/static/<group>/<filename>` route accepts `group=".."`, which causes `send_from_directory("static/..", filename)` to execute. This moves the base directory up to `/app/changedetectionio`, enabling unauthenticated local file read of application source files (e.g., `flask_app.py`). Version 0.53.2 fixes the issue. |
| CVE-2025-64500 | High | 2025-11-12 | Not applicable | Working exploit published | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`. |
| CVE-2025-62780 | Medium | 2025-11-10 | Not applicable | Working exploit published | changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload. In the second, an attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload. When the user clicks on *Preview* and then on the malicious link, the JavaScript malicious code is executed. Version 0.50.34 fixes the issue. |
| CVE-2025-27225 | High | 2025-10-27 | Not applicable | Working exploit published | TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers. |
| CVE-2025-60787 | High | 2025-10-03 | Not applicable | Working exploit published | MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted. |
| CVE-2025-8471 | Medium | 2025-08-02 | Not applicable | Working exploit published | A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of the file /adminlogin.php. The manipulation of the argument a_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-54597 | High | 2025-07-27 | Not applicable | Working exploit published | LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter. |
| CVE-2025-4302 | Medium | 2025-07-17 | Not applicable | Working exploit published | The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be bypassed by URL-encoding the API path. |
| CVE-2025-6965 | High | 2025-07-15 | Not applicable | Working exploit published | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. |
| CVE-2025-5961 | High | 2025-07-03 | Not applicable | Working exploit published | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers. |
| CVE-2024-6159 | Critical | 2025-05-15 | Not applicable | Working exploit published | The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection |
| CVE-2025-2594 | High | 2025-04-22 | Not applicable | Working exploit published | The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID. |
| CVE-2024-11044 | Medium | 2025-03-20 | Not applicable | Working exploit published | An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user credentials. |
| CVE-2024-13492 | Medium | 2025-02-07 | Not applicable | Working exploit published | The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. |
| CVE-2024-13220 | Medium | 2025-01-31 | Not applicable | Working exploit published | The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. |
| CVE-2024-12749 | High | 2025-01-29 | Not applicable | Working exploit published | The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. |
| CVE-2024-11605 | Medium | 2024-12-27 | Not applicable | Working exploit published | The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
| CVE-2024-9186 | High | 2024-11-14 | Not applicable | Working exploit published | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks |
| CVE-2024-42471 | High | 2024-09-02 | Not applicable | Working exploit published | actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue. |
| CVE-2024-7815 | Medium | 2024-08-15 | Not applicable | Working exploit published | A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-update-employee.php of the component Update Employee Page. The manipulation of the argument emp_fname /emp_lname /emp_nat_idno/emp_addr leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-38773 | Critical | 2024-07-22 | Not applicable | Working exploit published | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17. |
| CVE-2024-37081 | High | 2024-06-18 | Not applicable | Working exploit published | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance. |
| CVE-2024-30163 | Critical | 2024-06-07 | Not applicable | Working exploit published | Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries. This can be exploited by unauthenticated attackers to carry out Blind SQL Injection attacks. |
| CVE-2024-4399 | Critical | 2024-05-23 | Not applicable | Working exploit published | The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack |
| CVE-2024-2621 | Critical | 2024-03-19 | Not applicable | Working exploit published | A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwd_update.php. The manipulation of the argument uuid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257198 is the identifier assigned to this vulnerability. |
| CVE-2024-22318 | Medium | 2024-02-09 | Not applicable | Working exploit published | IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials. IBM X-Force ID: 279091. |
| CVE-2023-47211 | Critical | 2024-01-08 | Not applicable | Working exploit published | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability. |
| CVE-2023-5203 | High | 2023-12-26 | Not applicable | Working exploit published | The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique. |
| CVE-2023-48292 | Critical | 2023-11-20 | Mitigation candidate | Working exploit published | The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed. |
| CVE-2023-46024 | High | 2023-11-14 | Not applicable | Working exploit published | SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQL commands and obtain sensitive information via the 'searchdata' parameter. |
| CVE-2023-5003 | High | 2023-10-16 | Not applicable | Working exploit published | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so. |
| CVE-2023-5556 | Medium | 2023-10-12 | Not applicable | Working exploit published | Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194. |
| CVE-2023-2813 | Medium | 2023-09-04 | Not applicable | Working exploit published | All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2, BunnyPressLite WordPress theme before 2.1, Cafe Bistro WordPress theme before 1.1.4, College WordPress theme before 1.5.1, Connections Reloaded WordPress theme through 3.1, Counterpoint WordPress theme through 1.8.1, Digitally WordPress theme through 1.0.8, Directory WordPress theme before 3.0.2, Drop WordPress theme before 1.22, Everse WordPress theme before 1.2.4, Fashionable Store WordPress theme through 1.3.4, Fullbase WordPress theme before 1.2.1, Ilex WordPress theme before 1.4.2, Js O3 Lite WordPress theme through 1.5.8.2, Js Paper WordPress theme through 2.5.7, Kata WordPress theme before 1.2.9, Kata App WordPress theme through 1.0.5, Kata Business WordPress theme through 1.0.2, Looki Lite WordPress theme before 1.3.0, moseter WordPress theme through 1.3.1, Nokke WordPress theme before 1.2.4, Nothing Personal WordPress theme through 1.0.7, Offset Writing WordPress theme through 1.2, Opor Ayam WordPress theme through 18, Pinzolo WordPress theme before 1.2.10, Plato WordPress theme before 1.1.9, Polka Dots WordPress theme through 1.2, Purity Of Soul WordPress theme through 1.9, Restaurant PT WordPress theme before 1.1.3, Saul WordPress theme before 1.1.0, Sean Lite WordPress theme before 1.4.6, Tantyyellow WordPress theme through 1.0.0.5, TIJAJI WordPress theme through 1.43, Tiki Time WordPress theme through 1.3, Tuaug4 WordPress theme through 1.4, Tydskrif WordPress theme through 1.1.3, UltraLight WordPress theme through 1.2, Venice Lite WordPress theme before 1.5.5, Viala WordPress theme through 1.3.1, viburno WordPress theme before 1.3.2, Wedding Bride WordPress theme before 1.0.2, Wlow WordPress theme before 1.2.7 suffer from the same issue about the search box reflecting the results causing XSS which allows an unauthenticated attacker to exploit against users if they click a malicious link. |
| CVE-2023-34039 | Critical | 2023-08-29 | Not applicable | Working exploit published | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI. |
| CVE-2023-4111 | Medium | 2023-08-03 | Not applicable | Working exploit published | A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickup_id leads to cross site scripting. The attack may be launched remotely. VDB-235958 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2023-34635 | Critical | 2023-07-31 | Not applicable | Working exploit published | Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page. |
| CVE-2023-1780 | Medium | 2023-07-10 | Not applicable | Working exploit published | The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. |
| CVE-2023-33592 | Critical | 2023-06-28 | Not applicable | Working exploit published | Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_information. |
| CVE-2023-33440 | High | 2023-05-26 | Not applicable | Working exploit published | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user. |
| CVE-2023-33439 | High | 2023-05-26 | Not applicable | Working exploit published | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=. |
| CVE-2023-25439 | Medium | 2023-05-25 | Not applicable | Working exploit published | Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details. |
| CVE-2023-20864 | Critical | 2023-04-20 | Not applicable | Working exploit published | VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root. |
| CVE-2023-29506 | Medium | 2023-04-16 | Mitigation candidate | Working exploit published | XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10. |
| CVE-2022-34128 | Critical | 2023-04-16 | Not applicable | Working exploit published | The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. |
| CVE-2023-26918 | Critical | 2023-04-14 | Not applicable | Working exploit published | Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystem. This occurs because %ProgramFiles%\FileReplicationPro allows Everyone:(F) access. |
| CVE-2023-28288 | High | 2023-04-11 | Not applicable | Working exploit published | Microsoft SharePoint Server Spoofing Vulnerability |
| CVE-2022-2546 | Medium | 2023-02-02 | Not applicable | Working exploit published | The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key |
| CVE-2022-41622 | High | 2022-12-07 | Not applicable | Working exploit published | In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2022-38108 | High | 2022-10-20 | Not applicable | Working exploit published | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands. |
| CVE-2022-3569 | High | 2022-10-17 | Not applicable | Working exploit published | Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'. |
| CVE-2022-2863 | Medium | 2022-09-16 | Not applicable | Working exploit published | The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack |
| CVE-2022-2462 | Medium | 2022-09-06 | Not applicable | Working exploit published | The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text. |
| CVE-2021-24910 | Medium | 2022-08-22 | Not applicable | Working exploit published | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue |
| CVE-2022-2334 | High | 2022-08-17 | Not applicable | Working exploit published | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22. |
| CVE-2022-1373 | High | 2022-08-17 | Not applicable | Working exploit published | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk. |
| CVE-2022-37393 | High | 2022-08-16 | Not applicable | Working exploit published | Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root. |
| CVE-2022-31188 | Critical | 2022-08-01 | Outside Waratek scope | Working exploit published | CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue. |
| CVE-2022-0250 | Medium | 2022-07-04 | Not applicable | Working exploit published | The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting |
| CVE-2022-1013 | Critical | 2022-05-09 | Not applicable | Working exploit published | The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability. |
| CVE-2022-25568 | High | 2022-03-24 | Not applicable | Working exploit published | MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured. |
| CVE-2022-0349 | Critical | 2022-03-07 | Not applicable | Working exploit published | The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection |
| CVE-2022-26149 | High | 2022-02-26 | Not applicable | Working exploit published | MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator. |
| CVE-2021-42392 | Critical | 2022-01-10 | Protected by Waratek | Working exploit published | The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution. |
| CVE-2021-24862 | High | 2022-01-10 | Not applicable | Working exploit published | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue |
| CVE-2021-24849 | Critical | 2021-12-21 | Not applicable | Working exploit published | The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections |
| CVE-2021-44790 | Critical | 2021-12-20 | Outside Waratek scope | Working exploit published | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. |
| CVE-2021-36450 | Medium | 2021-12-15 | Not applicable | Working exploit published | Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. |
| CVE-2021-43405 | High | 2021-11-05 | Not applicable | Working exploit published | An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric). |
| CVE-2021-42667 | Critical | 2021-11-05 | Not applicable | Working exploit published | A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some cases he can use this vulnerability in order to get a remote code execution on the remote web server. |
| CVE-2021-42663 | Medium | 2021-11-05 | Not applicable | Working exploit published | An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a given link he will display the content of the HTML code of the attacker's choice. |
| CVE-2021-43339 | High | 2021-11-03 | Not applicable | Working exploit published | In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For example, a new admin user could be created. |
| CVE-2021-43140 | Critical | 2021-11-03 | Not applicable | Working exploit published | SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login. |
| CVE-2021-41878 | Medium | 2021-10-04 | Not applicable | Working exploit published | A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button. |
| CVE-2021-22015 | High | 2021-09-23 | Not applicable | Working exploit published | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance. |
| CVE-2021-39320 | Medium | 2021-09-01 | Not applicable | Working exploit published | The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path. |
| CVE-2021-39146 | High | 2021-08-23 | Mitigation candidate | Working exploit published | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. |
| CVE-2021-39141 | High | 2021-08-23 | Mitigation candidate | Working exploit published | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. |
| CVE-2021-31581 | High | 2021-07-22 | Not applicable | Working exploit published | The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later). |
| CVE-2021-22145 | Medium | 2021-07-21 | Mitigation candidate | Working exploit published | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details. |
| CVE-2020-27361 | High | 2021-07-01 | Not applicable | Working exploit published | An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories. |
| CVE-2021-31950 | High | 2021-06-08 | Not applicable | Working exploit published | Microsoft SharePoint Server Spoofing Vulnerability |
| CVE-2020-6950 | Medium | 2021-06-02 | Protected by Waratek | Working exploit published | Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. |
| CVE-2021-23017 | High | 2021-06-01 | Not applicable | Working exploit published | A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. |
| CVE-2021-29505 | High | 2021-05-28 | Mitigation candidate | Working exploit published | XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17. |
| CVE-2021-24299 | Medium | 2021-05-17 | Not applicable | Working exploit published | The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded. |
| CVE-2021-31181 | High | 2021-05-11 | Not applicable | Working exploit published | Microsoft SharePoint Remote Code Execution Vulnerability |
| CVE-2020-21998 | Medium | 2021-04-27 | Not applicable | Working exploit published | In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. |
| CVE-2021-28242 | High | 2021-04-15 | Not applicable | Working exploit published | SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cf_name" parameter when creating a new filter under the "Collections" tab. |
| CVE-2021-28164 | Medium | 2021-04-01 | Protected by Waratek | Working exploit published | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. |
| CVE-2021-21351 | Critical | 2021-03-23 | Outside Waratek scope | Working exploit published | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. |
| CVE-2021-21345 | Critical | 2021-03-23 | Protected by Waratek | Working exploit published | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. |
| CVE-2020-22841 | Medium | 2021-02-09 | Not applicable | Working exploit published | Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module. |
| CVE-2020-22840 | Medium | 2021-02-09 | Not applicable | Working exploit published | Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php. |
| CVE-2021-26914 | High | 2021-02-08 | Not applicable | Working exploit published | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject. |
| CVE-2020-35687 | Medium | 2021-01-13 | Not applicable | Working exploit published | PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. |
| CVE-2020-35437 | Medium | 2020-12-26 | Not applicable | Working exploit published | Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI. |
| CVE-2020-35151 | High | 2020-12-21 | Not applicable | Working exploit published | The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection. |