Overview 23 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
4.3%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
22
95.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
23
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
23
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 6 / year
20051
Not applicable1
Medium1
not blocked1
Working exploit published1
20063
Not applicable3
High3
not blocked3
Working exploit published3
20070
20081
Not applicable1
High1
not blocked1
Working exploit published1
20096
Not applicable6
High1
Medium5
not blocked6
Working exploit published6
20101
Not applicable1
High1
not blocked1
Working exploit published1
20110
20123
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20131
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20140
20151
Not applicable1
Medium1
not blocked1
Working exploit published1
20160
20170
20183
Not applicable3
High2
Medium1
not blocked3
Working exploit published3
20190
20201
Not applicable1
High1
not blocked1
Working exploit published1
20210
20220
20230
20242
Not applicable2
Critical1
Medium1
not blocked2
Working exploit published2
2006200820102012201420162018202020222024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-30502 | Critical | 2024-03-29 | Not applicable | Working exploit published | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9. |
| CVE-2024-0337 | Medium | 2024-03-20 | Not applicable | Working exploit published | The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. |
| CVE-2020-10963 | High | 2020-03-25 | Not applicable | Working exploit published | FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued. |
| CVE-2017-18256 | Medium | 2018-04-04 | Not applicable | Working exploit published | Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaScript code, because window dialogs are mishandled. |
| CVE-2016-10718 | High | 2018-04-04 | Not applicable | Working exploit published | Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service. |
| CVE-2018-8947 | High | 2018-03-25 | Not applicable | Working exploit published | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request. |
| CVE-2015-2755 | Medium | 2015-04-01 | Not applicable | Working exploit published | Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php. |
| CVE-2013-1814 | Medium | 2013-03-14 | Mitigation candidate | Working exploit published | The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response. |
| CVE-2012-4281 | High | 2012-08-13 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to (1) holiday.php or (2) holiday_book.php, (3) id parameter to pages.php, (4) fid parameter to admin/airline-edit.php, or (5) cid parameter to admin/customer-edit.php. |
| CVE-2012-2939 | Medium | 2012-05-27 | Not applicable | Working exploit published | Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php. |
| CVE-2012-2938 | Medium | 2012-05-27 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the holiday name field to (1) holiday_add.php or (2) holiday_view.php. |
| CVE-2010-1535 | High | 2010-04-26 | Not applicable | Working exploit published | Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php. |
| CVE-2009-4085 | High | 2009-11-29 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in assets/plugins/mp3_id/mp3_id.php in PHP Traverser 0.8.0 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[BASE] parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2009-0678 | Medium | 2009-02-22 | Not applicable | Working exploit published | images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message. |
| CVE-2009-0677 | Medium | 2009-02-22 | Not applicable | Working exploit published | avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the preg_replace function with the eval switch, as specified in an element of the patterns array. |
| CVE-2009-0674 | Medium | 2009-02-22 | Not applicable | Working exploit published | images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows remote attackers to determine the existence of local files by sending requests with full pathnames in the aFonts array parameter, and then observing the error messages, which differ between existing and nonexistent pathnames. |
| CVE-2009-0673 | Medium | 2009-02-22 | Not applicable | Working exploit published | Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php. |
| CVE-2009-0672 | Medium | 2009-02-22 | Not applicable | Working exploit published | SQL injection vulnerability in the Resend_Email module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the user_prefix parameter to modules.php. |
| CVE-2008-1324 | High | 2008-03-13 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in index.php in Travelsized CMS 0.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) page_id and (2) language parameters. NOTE: this might be the same issue as CVE-2008-1325. |
| CVE-2006-6559 | High | 2006-12-14 | Not applicable | Working exploit published | SQL injection vulnerability in ProductDetails.asp in Lotfian Request For Travel 1.0 allows remote attackers to execute arbitrary SQL commands via the PID parameter. |
| CVE-2006-5621 | High | 2006-10-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in end.php in ask_rave 0.9 PR, and other versions before 0.9b, allows remote attackers to execute arbitrary PHP code via a URL in the footfile parameter. |
| CVE-2006-5182 | High | 2006-10-10 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in frontpage.php in Dan Jensen Travelsized CMS 0.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the setup_folder parameter. |
| CVE-2005-4381 | Medium | 2005-12-20 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fileDN and (2) folderviewer_attrs parameters. |