Overview 37 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
37
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
37
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
37
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 20 / year
19991
Not applicable1
High1
not blocked1
Working exploit published1
20000
20010
20020
20030
20040
20051
Not applicable1
Low1
not blocked1
Working exploit published1
20060
20071
Not applicable1
High1
not blocked1
Working exploit published1
20083
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20090
20102
Not applicable2
High2
not blocked2
Working exploit published2
20110
20120
20130
20140
20150
20160
20172
Not applicable2
Critical1
Medium1
not blocked2
Working exploit published2
201820
Not applicable20
Critical2
High2
Medium16
not blocked20
Working exploit published20
20191
Not applicable1
Medium1
not blocked1
Working exploit published1
20201
Not applicable1
Medium1
not blocked1
Working exploit published1
20212
Not applicable2
Medium2
not blocked2
Working exploit published2
20222
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20231
Not applicable1
Medium1
not blocked1
Working exploit published1
1999200120032005200720092011201320152017201920212023
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-1263 | Medium | 2023-03-07 | Not applicable | Working exploit published | The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled. |
| CVE-2022-41622 | High | 2022-12-07 | Not applicable | Working exploit published | In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2021-24926 | Medium | 2022-02-01 | Not applicable | Working exploit published | The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue |
| CVE-2020-20988 | Medium | 2021-08-12 | Not applicable | Working exploit published | A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter. |
| CVE-2021-27695 | Medium | 2021-03-15 | Not applicable | Working exploit published | Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters. |
| CVE-2020-15038 | Medium | 2020-06-24 | Not applicable | Working exploit published | The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS. |
| CVE-2019-15811 | Medium | 2019-08-29 | Not applicable | Working exploit published | In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS. |
| CVE-2018-1000856 | Medium | 2018-12-20 | Not applicable | Working exploit published | DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear to be exploitable via Victim must visit the vulnerable page. This vulnerability appears to have been fixed in No fix yet. |
| CVE-2018-20011 | Medium | 2018-12-10 | Not applicable | Working exploit published | DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field. |
| CVE-2018-20010 | Medium | 2018-12-10 | Not applicable | Working exploit published | DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field. |
| CVE-2018-20009 | Medium | 2018-12-10 | Not applicable | Working exploit published | DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field. |
| CVE-2018-19915 | Medium | 2018-12-06 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field. |
| CVE-2018-19914 | Medium | 2018-12-06 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field. |
| CVE-2018-19913 | Medium | 2018-12-06 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field. |
| CVE-2018-19892 | Medium | 2018-12-06 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field. |
| CVE-2018-19752 | Medium | 2018-11-29 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar. |
| CVE-2018-19751 | Medium | 2018-11-29 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields. |
| CVE-2018-19750 | Medium | 2018-11-29 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields. |
| CVE-2018-19749 | Medium | 2018-11-29 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field. |
| CVE-2018-19137 | Medium | 2018-11-09 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter. |
| CVE-2018-19136 | Medium | 2018-11-09 | Not applicable | Working exploit published | DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter. |
| CVE-2018-13405 | High | 2018-07-06 | Not applicable | Working exploit published | The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID. |
| CVE-2018-10662 | Critical | 2018-06-26 | Not applicable | Working exploit published | An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface. |
| CVE-2018-10660 | Critical | 2018-06-26 | Not applicable | Working exploit published | An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection. |
| CVE-2018-11404 | Medium | 2018-05-24 | Not applicable | Working exploit published | DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter. |
| CVE-2018-11403 | Medium | 2018-05-24 | Not applicable | Working exploit published | DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter. |
| CVE-2018-5511 | High | 2018-04-13 | Not applicable | Working exploit published | On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. |
| CVE-2017-17594 | Critical | 2017-12-13 | Not applicable | Working exploit published | DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter. |
| CVE-2017-14841 | Medium | 2017-09-28 | Not applicable | Working exploit published | Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handling. |
| CVE-2010-1046 | High | 2010-03-23 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in index.php in Rostermain 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) userid (username) and (2) password parameters. |
| CVE-2010-0973 | High | 2010-03-16 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in phppool media Domain Verkaus and Auktions Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2008-5788 | High | 2008-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in Domain Seller Pro 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2008-1560 | Medium | 2008-03-31 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Digiappz DigiDomain 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) domain parameter to lookup_result.asp, and the (2) word1 and (3) word2 parameters to suggest_result.asp. |
| CVE-2008-0688 | Medium | 2008-02-12 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in catalog.php in Smartscript Domain Trader 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter in a viewcategory action. |
| CVE-2006-7120 | High | 2007-03-06 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in lib/php/phphtmllib-2.5.4/examples/example6.php for maintain 3.0.0-RC2 allows remote attackers to execute arbitrary PHP code via a URL in the phphtmllib parameter. NOTE: this issue might be in phpHtmlLib. NOTE: CVE disputes this issue for proper installations of maintain, since $phphtmllib is set in includes.inc before being used in example6.php |
| CVE-2005-3320 | Low | 2005-10-27 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in SiteTurn Domain Manager Pro allows remote attackers to inject arbitrary web script or HTML via the err parameter in the panel script. |
| CVE-1999-1063 | High | 1999-06-01 | Not applicable | Working exploit published | CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter. |