Overview 194 matches · 1 in Waratek scope · 1 protected · 2 exploited · 0 CISA KEV · 10 public PoC · 0 EPSS ≥ 0.5
194matches
1in Waratek scope0.5%
1protected0.5%
2exploited1.0%
0CISA KEV0.0%
10public PoC5.2%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
0.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
193
99.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.5%
partly blocked
0
0.0%
not blocked
193
99.5%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 78 / year
20041
Not applicable1
High1
not blocked1
No public exploit1
20050
20061
Not applicable1
High1
not blocked1
Working exploit published1
20071
Not applicable1
Medium1
not blocked1
Working exploit published1
20085
Not applicable5
High5
not blocked5
Working exploit published4
No public exploit1
20091
Not applicable1
High1
not blocked1
Working exploit published1
20100
20110
20121
Not applicable1
High1
not blocked1
Working exploit published1
20130
20142
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20150
20161
Not applicable1
Critical1
not blocked1
No public exploit1
20171
Not applicable1
Critical1
not blocked1
Exploited1
20189
Protected by Waratek1
Not applicable8
Critical2
High3
Medium4
blocked by ARMR today1
not blocked8
Working exploit published1
No public exploit8
20194
Not applicable4
Critical1
High1
Medium2
not blocked4
No public exploit4
20205
Not applicable5
Critical1
High4
not blocked5
No public exploit5
202116
Not applicable16
Critical4
High5
Medium7
not blocked16
No public exploit16
202220
Not applicable20
Critical3
High3
Medium14
not blocked20
No public exploit20
202320
Not applicable20
Critical6
High7
Medium7
not blocked20
Proof of concept only13
No public exploit7
202478
Not applicable78
High43
Medium32
Low3
not blocked78
Exploited1
Proof of concept only68
No public exploit9
202522
Not applicable22
Critical5
High4
Medium9
Low4
not blocked22
Proof of concept only17
No public exploit5
20266
Not applicable6
High1
Medium1
Low4
not blocked6
Proof of concept only5
No public exploit1
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-40745 | Medium | 2026-04-14 | Not applicable | No public exploit | A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks. |
| CVE-2026-3289 | Low | 2026-02-27 | Not applicable | Proof of concept only | A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-69437 | High | 2026-02-27 | Not applicable | Proof of concept only | PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be triggered, resulting in issues such as credential theft, arbitrary API execution, and other security concerns. This vulnerability affects all file upload endpoint, including /cmsTemplate/save, /file/doUpload, /cmsTemplate/doUpload, /file/doBatchUpload, /cmsWebFile/doUpload, etc. |
| CVE-2026-2010 | Low | 2026-02-06 | Not applicable | Proof of concept only | A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue. |
| CVE-2026-1112 | Low | 2026-01-18 | Not applicable | Proof of concept only | A vulnerability was found in Sanluan PublicCMS up to 5.202506.d. Affected is the function delete of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeAddressController.java of the component Trade Address Deletion Endpoint. Performing a manipulation of the argument ids results in improper authorization. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-1111 | Low | 2026-01-18 | Not applicable | Proof of concept only | A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-65837 | Medium | 2025-12-22 | Not applicable | Proof of concept only | PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. |
| CVE-2025-65840 | High | 2025-12-01 | Not applicable | Proof of concept only | PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController. |
| CVE-2025-65838 | High | 2025-12-01 | Not applicable | Proof of concept only | PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method. |
| CVE-2025-65836 | Critical | 2025-12-01 | Not applicable | Proof of concept only | PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController. |
| CVE-2025-64048 | Medium | 2025-11-24 | Not applicable | No public exploit | YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field. |
| CVE-2025-57516 | High | 2025-09-29 | Not applicable | Proof of concept only | OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file. |
| CVE-2025-10397 | Low | 2025-09-14 | Not applicable | No public exploit | A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used. |
| CVE-2025-10395 | Medium | 2025-09-14 | Not applicable | No public exploit | A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely. |
| CVE-2025-10122 | Low | 2025-09-09 | Not applicable | No public exploit | A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulation of the argument where results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. |
| CVE-2025-51818 | Medium | 2025-08-21 | Not applicable | Proof of concept only | MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands |
| CVE-2025-50234 | Medium | 2025-08-06 | Not applicable | Proof of concept only | MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key (bD2voYwPpNuJ7B8), defined in the db.php file. The decrypted URL is passed to the geturl() method, which uses cURL to make a request to the URL without proper security checks. An attacker can craft a malicious encrypted pic parameter, which, when decrypted, points to internal addresses or local file paths (such as http://127.0.0.1 or file://). By using the file:// protocol, the attacker can access arbitrary files on the local file system (e.g., file:///etc/passwd, file:///C:/Windows/System32/drivers/etc/hosts), allowing them to read sensitive configuration files, log files, and more, leading to information leakage or system exposure. The danger of this SSRF vulnerability includes accessing internal services and local file systems through protocols like http://, ftp://, and file://, which can result in sensitive data leakage, remote code execution, privilege escalation, or full system compromise, severely affecting the system's security and stability. |
| CVE-2025-7953 | Low | 2025-07-22 | Not applicable | No public exploit | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. The manipulation of the argument File leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue. |
| CVE-2025-7949 | Low | 2025-07-22 | Not applicable | Proof of concept only | A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named c1e79f124e3f4c458315d908ed7dee06f9f12a76/f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue. |
| CVE-2025-51651 | Medium | 2025-07-14 | Not applicable | Proof of concept only | An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request. |
| CVE-2025-5328 | Medium | 2025-05-29 | Not applicable | Proof of concept only | A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the argument dirs leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-5327 | Medium | 2025-05-29 | Not applicable | Proof of concept only | A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-45474 | High | 2025-05-29 | Not applicable | Proof of concept only | maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings. |
| CVE-2025-45475 | Medium | 2025-05-27 | Not applicable | Proof of concept only | maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management. |
| CVE-2025-28091 | Critical | 2025-03-28 | Not applicable | Proof of concept only | maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article. |
| CVE-2025-28090 | Critical | 2025-03-28 | Not applicable | Proof of concept only | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature. |
| CVE-2025-28089 | Critical | 2025-03-28 | Not applicable | Proof of concept only | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function. |
| CVE-2025-25361 | Critical | 2025-03-06 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file. |
| CVE-2024-11587 | Medium | 2024-11-21 | Not applicable | Exploited | A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php. The manipulation of the argument idName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-11175 | Medium | 2024-11-13 | Not applicable | Proof of concept only | A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue. |
| CVE-2024-21938 | High | 2024-11-12 | Not applicable | No public exploit | Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
| CVE-2024-11070 | Medium | 2024-11-11 | Not applicable | Proof of concept only | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-46410 | Medium | 2024-10-08 | Not applicable | Proof of concept only | PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature |
| CVE-2024-46654 | Medium | 2024-09-20 | Not applicable | Proof of concept only | A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-42523 | High | 2024-08-23 | Not applicable | Proof of concept only | publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData |
| CVE-2024-40552 | High | 2024-07-12 | Not applicable | No public exploit | PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java. |
| CVE-2024-40551 | High | 2024-07-12 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40550 | High | 2024-07-12 | Not applicable | No public exploit | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40549 | High | 2024-07-12 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40548 | High | 2024-07-12 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40547 | Medium | 2024-07-12 | Not applicable | Proof of concept only | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. |
| CVE-2024-40546 | High | 2024-07-12 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40545 | High | 2024-07-12 | Not applicable | No public exploit | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40544 | High | 2024-07-12 | Not applicable | Proof of concept only | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit. |
| CVE-2024-40543 | High | 2024-07-12 | Not applicable | Proof of concept only | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage. |
| CVE-2024-40336 | Medium | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.' |
| CVE-2024-40334 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3 |
| CVE-2024-40333 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=del&dataID=2 |
| CVE-2024-40332 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord |
| CVE-2024-40331 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup |
| CVE-2024-40329 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup |
| CVE-2024-40328 | Medium | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6 |
| CVE-2024-40039 | High | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del |
| CVE-2024-40038 | Medium | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev |
| CVE-2024-40037 | High | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=del |
| CVE-2024-40036 | High | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=add&nohrefStr=close |
| CVE-2024-40035 | Medium | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add. |
| CVE-2024-40034 | High | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=del |
| CVE-2024-39023 | High | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=close |
| CVE-2024-39022 | High | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=deal |
| CVE-2024-39021 | Medium | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData_deal.php?mudi=del |
| CVE-2024-39020 | Medium | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=close |
| CVE-2024-39019 | Medium | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData_deal.php?mudi=del |
| CVE-2024-39119 | Medium | 2024-07-02 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-39158 | High | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mudi=infoSet. |
| CVE-2024-39157 | Low | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1. |
| CVE-2024-39156 | Low | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=add. |
| CVE-2024-39155 | Medium | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=add. |
| CVE-2024-39154 | High | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=del&dataType=word&dataTypeCN. |
| CVE-2024-39153 | Medium | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/info_deal.php?mudi=del&dataType=news&dataTypeCN. |
| CVE-2024-36670 | High | 2024-06-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del |
| CVE-2024-36669 | High | 2024-06-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add. |
| CVE-2024-36668 | High | 2024-06-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=del |
| CVE-2024-36667 | High | 2024-06-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType_deal.php?mudi=add&nohrefStr=close |
| CVE-2024-36550 | High | 2024-06-04 | Not applicable | Proof of concept only | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close |
| CVE-2024-36549 | High | 2024-06-04 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close |
| CVE-2024-36548 | High | 2024-06-04 | Not applicable | Proof of concept only | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany_deal.php?mudi=del |
| CVE-2024-36547 | High | 2024-06-04 | Not applicable | Proof of concept only | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=add |
| CVE-2024-35561 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close. |
| CVE-2024-35560 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=del&dataType=&dataTypeCN. |
| CVE-2024-35559 | High | 2024-05-22 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-35558 | High | 2024-05-22 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-35557 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-35556 | High | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet. |
| CVE-2024-35555 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=newsWeb&fieldName=state&fieldName2=state&tabName=infoWeb&dataID=40. |
| CVE-2024-35554 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN. |
| CVE-2024-35553 | High | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=add&nohrefStr=close. |
| CVE-2024-35552 | High | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=del&dataType=logo&dataTypeCN. |
| CVE-2024-35551 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=add. |
| CVE-2024-35550 | Medium | 2024-05-22 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=rev. |
| CVE-2024-35039 | Low | 2024-05-16 | Not applicable | Proof of concept only | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/tplSys_deal.php?mudi=area. |
| CVE-2024-34958 | Medium | 2024-05-16 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner_deal.php?mudi=add |
| CVE-2024-34957 | Medium | 2024-05-16 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages_deal.php?mudi=infoSet. |
| CVE-2024-35109 | Medium | 2024-05-15 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro_deal.php?mudi=add&nohrefStr=close. |
| CVE-2024-35108 | High | 2024-05-15 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN. |
| CVE-2024-35012 | Medium | 2024-05-14 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=close. |
| CVE-2024-35011 | Medium | 2024-05-14 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-35010 | High | 2024-05-14 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner_deal.php?mudi=del&dataType=&dataTypeCN=%E5%9B%BE%E7%89%87%E5%B9%BF%E5%91%8A&theme=cs&dataID=6. |
| CVE-2024-35009 | High | 2024-05-14 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&fieldName=state&fieldName2=state&tabName=banner&dataID=6. |
| CVE-2024-33830 | High | 2024-05-06 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache. |