WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product mcms✕
Overview 17 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
17matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.55.9%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 5 29.4% Not applicable 12 70.6% Withdrawn CVE 0 0.0%
Critical 8 47.1% High 6 35.3% Medium 3 17.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 17 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 17 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 8 / year
Not applicable: 12Outside Waratek scope: 5 Medium: 3High: 6Critical: 8 not blocked: 17 Working exploit published: 17
20071 Not applicable1 High1 not blocked1 Working exploit published1 20084 Not applicable4 High4 not blocked4 Working exploit published4 20090 20100 20110 20120 20130 20141 Not applicable1 High1 not blocked1 Working exploit published1 20150 20160 20170 20181 Not applicable1 Medium1 not blocked1 Working exploit published1 20190 20200 20210 20228 Outside Waratek scope3 Not applicable5 Critical7 Medium1 not blocked8 Working exploit published8 20232 Outside Waratek scope2 Critical1 Medium1 not blocked2 Working exploit published2
200720092011201320152017201920212023
17 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-50578 Critical 2023-12-30 Outside Waratek scope Working exploit published Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
CVE-2023-3990 Medium 2023-07-28 Outside Waratek scope Working exploit published A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
CVE-2022-4375 Critical 2022-12-09 Outside Waratek scope Working exploit published A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.
CVE-2022-28033 Critical 2022-04-12 Not applicable Working exploit published Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php
CVE-2022-28032 Critical 2022-04-12 Not applicable Working exploit published AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php
CVE-2022-26585 Critical 2022-04-05 Outside Waratek scope Working exploit published Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
CVE-2022-25489 Medium 2022-03-15 Not applicable Working exploit published Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php.
CVE-2022-25125 Critical 2022-03-03 Not applicable Working exploit published MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
CVE-2022-23898 Critical 2022-03-03 Outside Waratek scope Working exploit published MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
CVE-2022-24223 Critical 2022-02-01 Not applicable Working exploit published AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.
CVE-2018-7653 Medium 2018-03-04 Not applicable Working exploit published In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.
CVE-2014-4852 High 2014-07-10 Not applicable Working exploit published SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-5708 High 2008-12-24 Not applicable Working exploit published redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the newusername and newpassword parameters and setting the newisadmin parameter to 1.
CVE-2008-5491 High 2008-12-12 Not applicable Working exploit published SQL injection vulnerability in edit.php in SlimCMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pageID parameter.
CVE-2008-3721 High 2008-08-20 Not applicable Working exploit published PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.
CVE-2008-3720 High 2008-08-20 Not applicable Working exploit published SQL injection vulnerability in index.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the id vector is already covered by CVE-2007-5679.
CVE-2007-5679 High 2007-10-25 Not applicable Working exploit published SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in the media page (build_media_content.php). NOTE: it was later reported that 0.7.4 is also affected.