Overview 55 matches · 0 in Waratek scope · 0 protected · 3 exploited · 2 CISA KEV · 8 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
1.8%
Not applicable
54
98.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
55
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
3
5.5%
Working exploit published
52
94.5%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 11 / year
20002
Not applicable2
High2
not blocked2
Working exploit published2
20011
Not applicable1
High1
not blocked1
Working exploit published1
20021
Not applicable1
High1
not blocked1
Working exploit published1
20031
Not applicable1
Medium1
not blocked1
Working exploit published1
20047
Not applicable7
High4
Medium3
not blocked7
Working exploit published7
200511
Not applicable11
High7
Medium4
not blocked11
Working exploit published11
20067
Not applicable7
High3
Medium4
not blocked7
Working exploit published7
20073
Not applicable3
High2
Medium1
not blocked3
Working exploit published3
20089
Not applicable9
High6
Medium3
not blocked9
Working exploit published9
20095
Not applicable5
High4
Medium1
not blocked5
Working exploit published5
20102
Not applicable2
High2
not blocked2
Working exploit published2
20110
20120
20130
20140
20150
20160
20170
20182
Not applicable2
Critical2
not blocked2
Working exploit published2
20190
20200
20211
Not applicable1
Critical1
not blocked1
Exploited1
20220
20230
20240
20252
Not applicable2
Critical1
Medium1
not blocked2
Exploited1
Working exploit published1
20261
Outside Waratek scope1
Critical1
not blocked1
Exploited1
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-111497 | Critical | 2026-10-22 | Outside Waratek scope | Exploited | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. |
| CVE-2025-1661 | Critical | 2025-03-11 | Not applicable | Exploited | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. |
| CVE-2024-13220 | Medium | 2025-01-31 | Not applicable | Working exploit published | The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. |
| CVE-2021-23758 | Critical | 2021-12-03 | Not applicable | Exploited | All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution. |
| CVE-2018-13859 | Critical | 2018-07-17 | Not applicable | Working exploit published | MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18, allow unauthorized remote attackers to reset the authentication via the "/xml/system/setAttribute.xml" URL, using the GET request "?id=0&attr=protectAccess&newValue=0" (a successful attack will allow attackers to login without authorization). |
| CVE-2018-5973 | Critical | 2018-01-25 | Not applicable | Working exploit published | SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter, or the suppliers.php IndustryID or CategoryID parameter. |
| CVE-2010-4186 | High | 2010-11-05 | Not applicable | Working exploit published | SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2010-0705 | High | 2010-02-25 | Not applicable | Working exploit published | Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, which allows local users to cause a denial of service (system crash) or execute arbitrary code to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption. |
| CVE-2009-4216 | High | 2009-12-07 | Not applicable | Working exploit published | Directory traversal vulnerability in funzioni/lib/menulast.php in klinza professional cms 5.0.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG parameter. |
| CVE-2009-4049 | High | 2009-11-23 | Not applicable | Working exploit published | Heap-based buffer overflow in aswRdr.sys (aka the TDI RDR driver) in avast! Home and Professional 4.8.1356.0 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted arguments to IOCTL 0x80002024. |
| CVE-2009-3523 | Medium | 2009-10-01 | Not applicable | Working exploit published | aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625. |
| CVE-2009-3522 | High | 2009-10-01 | Not applicable | Working exploit published | Stack-based buffer overflow in aswMon2.sys in avast! Home and Professional for Windows 4.8.1351, and possibly other versions before 4.8.1356, allows local users to cause a denial of service (system crash) and possibly gain privileges via a crafted IOCTL request to IOCTL 0xb2c80018. |
| CVE-2008-6378 | High | 2009-03-02 | Not applicable | Working exploit published | SQL injection vulnerability in calendar_Eventupdate.asp in Calendar Mx Professional 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter. |
| CVE-2008-5572 | Medium | 2008-12-15 | Not applicable | Working exploit published | Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for database/downloads.mdb. |
| CVE-2008-5571 | High | 2008-12-15 | Not applicable | Working exploit published | SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter (aka user field) or the (2) psw parameter (aka passwd field). NOTE: some of these details are obtained from third party information. |
| CVE-2008-4890 | High | 2008-11-04 | Not applicable | Working exploit published | SQL injection vulnerability in products.php in 1st News 4 Professional (PR 1) allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2008-1625 | Medium | 2008-04-02 | Not applicable | Working exploit published | aavmker4.sys in avast! Home and Professional 4.7 for Windows does not properly validate input to IOCTL 0xb2d60030, which allows local users to gain privileges via certain IOCTL requests. |
| CVE-2008-1277 | High | 2008-03-10 | Not applicable | Working exploit published | The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a denial of service (crash) via (1) SEARCH and (2) APPEND commands without required arguments, which triggers a NULL pointer dereference. |
| CVE-2008-1276 | High | 2008-03-10 | Not applicable | Working exploit published | Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow remote authenticated attackers to execute arbitrary code via long arguments to the (1) FETCH, (2) EXAMINE, and (3) UNSUBSCRIBE commands. |
| CVE-2008-1275 | High | 2008-03-10 | Not applicable | Working exploit published | Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x and earlier, and Enterprise Edition 3.x and earlier allow remote attackers to cause a denial of service (crash) via crafted (1) EXPN or (2) VRFY commands. |
| CVE-2008-0756 | Medium | 2008-02-13 | Not applicable | Working exploit published | The LPD server in cyan soft Opium OPI Server 4.10.1028 and earlier; cyanPrintIP Easy OPI, Professional, and Basic 4.10.1030 and earlier; Workstation 4.10.836 and earlier; and Standard 4.10.940 and earlier; allows remote attackers to cause a denial of service (daemon crash) via a connection that begins with (1) a "Send queue state" LPD command 3 or (2) a "Send queue state" LPD command 4. |
| CVE-2008-0755 | High | 2008-02-13 | Not applicable | Working exploit published | Format string vulnerability in the ReportSysLogEvent function in the LPD server in cyan soft Opium OPI Server 4.10.1028 and earlier; cyanPrintIP Easy OPI, Professional, and Basic 4.10.1030 and earlier; Workstation 4.10.836 and earlier; and Standard 4.10.940 and earlier; might allow remote attackers to execute arbitrary code via format string specifiers in the queue name in a request. |
| CVE-2007-5785 | High | 2007-11-01 | Not applicable | Working exploit published | SQL injection vulnerability in file.php in JobSite Professional 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2007-4479 | Medium | 2007-08-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in search.html in Search Engine Builder allows remote attackers to inject arbitrary web script or HTML via the searWords parameter. |
| CVE-2007-1301 | High | 2007-03-07 | Not applicable | Working exploit published | Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authenticated users to execute arbitrary code via a long argument to the APPEND command. NOTE: this is probably different than CVE-2006-6423. |
| CVE-2006-6423 | High | 2006-12-12 | Not applicable | Working exploit published | Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string, as addressed by the ME-10025 hotfix. |
| CVE-2006-6446 | Medium | 2006-12-10 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the D parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2006-5189 | High | 2006-10-10 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in funzioni/lib/show_hlp.php in klinza professional cms 5.0.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the appl[APPL] parameter. |
| CVE-2006-5177 | High | 2006-10-10 | Not applicable | Working exploit published | The NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to (1) execute arbitrary code via unspecified vectors involving crafted base64 encoded NTLM Type 3 messages, or (2) cause a denial of service via crafted base64 encoded NTLM Type 1 messages, which trigger a buffer over-read. |
| CVE-2006-3277 | Medium | 2006-06-28 | Not applicable | Working exploit published | The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC hotfix, allows remote attackers to cause a denial of service (application crash) via a HELO command with a null byte in the argument, possibly triggering a length inconsistency or a missing argument. |
| CVE-2006-2351 | Medium | 2006-05-15 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp. |
| CVE-2006-0073 | Medium | 2006-01-04 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in DiscusWare Discus Freeware 3.10.5 and Professional 3.10.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a URL, which is not properly sanitized from the resulting error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2005-4456 | High | 2005-12-21 | Not applicable | Working exploit published | Multiple buffer overflows in MailEnable Professional 1.71 and Enterprise 1.1 before patch ME-10009 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long (1) LIST, (2) LSUB, and (3) UID FETCH commands. NOTE: it is possible that these are alternate vectors for the issue described in CVE-2005-4402. |
| CVE-2005-4402 | Medium | 2005-12-20 | Not applicable | Working exploit published | Buffer overflow in MailEnable Professional 1.71 and earlier, and Enterprise 1.1 and earlier, allows remote authenticated users to execute arbitrary code via a long IMAP EXAMINE command. |
| CVE-2005-4177 | Medium | 2005-12-12 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter. |
| CVE-2005-4034 | High | 2005-12-06 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Web4Future eDating Professional 5 allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) pg, and (3) sortb parameters to (a) index.php; (4) cid parameter to (b) gift.php and (c) fq.php; and (5) cat parameter to (d) articles.php. |
| CVE-2005-3813 | Medium | 2005-11-26 | Not applicable | Working exploit published | IMAP service (meimaps.exe) of MailEnable Professional 1.7 and Enterprise 1.1 allows remote authenticated attackers to cause a denial of service (application crash) by using RENAME with a non-existent mailbox, a different vulnerability than CVE-2005-3690. |
| CVE-2005-3155 | High | 2005-10-05 | Not applicable | Working exploit published | Buffer overflow in the W3C logging for MailEnable Enterprise 1.1 and Professional 1.6 allows remote attackers to execute arbitrary code. |
| CVE-2005-2278 | High | 2005-07-18 | Not applicable | Working exploit published | Stack-based buffer overflow in the IMAP daemon (imapd) in MailEnable Professional 1.54 allows remote authenticated users to execute arbitrary code via the status command with a long mailbox name. |
| CVE-2005-1412 | High | 2005-05-03 | Not applicable | Working exploit published | SQL injection vulnerability in verify.asp for Ecomm Professional Guestbook 3.x allows remote attackers to execute arbitrary SQL commands via the AdminPWD parameter. |
| CVE-2005-1348 | High | 2005-05-02 | Not applicable | Working exploit published | Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary code via a long HTTP Authorization header. |
| CVE-2005-1013 | Medium | 2005-05-02 | Not applicable | Working exploit published | The SMTP service in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to cause a denial of service (server crash) via an EHLO command with a Unicode string. |
| CVE-2005-0185 | High | 2005-05-02 | Not applicable | Working exploit published | Stack-based buffer overflow in NodeManager Professional 2.00 allows remote attackers to execute arbitrary commands via a LinkDown-Trap packet that contains a long OCTET-STRING in the Trap variable-bindings field. |
| CVE-2004-2501 | High | 2004-12-31 | Not applicable | Working exploit published | Buffer overflow in the IMAP service of MailEnable Professional Edition 1.52 and Enterprise Edition 1.01 allows remote attackers to execute arbitrary code via (1) a long command string or (2) a long string to the MEIMAP service and then terminating the connection. |
| CVE-2004-2129 | Medium | 2004-12-31 | Not applicable | Working exploit published | SurfNOW 2.2 allows remote attackers to cause a denial of service (crash) via a series of long HTTP GET requests, possibly triggering a buffer overflow. |
| CVE-2004-1955 | High | 2004-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in modules.php in phProfession 2.5 allows remote attackers to execute arbitrary SQL code via the offset parameter. |
| CVE-2004-1953 | Medium | 2004-12-31 | Not applicable | Working exploit published | phProfession 2.5 allows remote attackers to gain sensitive information via a direct HTTP request to upload.php, which reveals the path in a PHP error message. |
| CVE-2004-0326 | High | 2004-11-23 | Not applicable | Working exploit published | Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request. |
| CVE-2004-1661 | High | 2004-09-02 | Not applicable | Working exploit published | MailWorks Professional allows remote attackers to bypass authentication and gain privileges via a cookie that contains "auth=1" and "uId=1." |
| CVE-2004-1954 | Medium | 2004-04-21 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in modules.php in phProfession 2.5 allows remote attackers to inject arbitrary web script or HTML via the jcode parameter. |
| CVE-2003-1469 | Medium | 2003-12-31 | Not applicable | Working exploit published | The default configuration of ColdFusion MX has the "Enable Robust Exception Information" option selected, which allows remote attackers to obtain the full path of the web server via a direct request to CFIDE/probe.cfm, which leaks the path in an error message. |
| CVE-2002-0495 | High | 2002-08-12 | Not applicable | Working exploit published | csSearch.cgi in csSearch 2.3 and earlier allows remote attackers to execute arbitrary Perl code via the savesetup command and the setup parameter, which overwrites the setup.cgi configuration file that is loaded by csSearch.cgi. |
| CVE-2001-0626 | High | 2001-08-22 | Not applicable | Working exploit published | O'Reilly Website Professional 2.5.4 and earlier allows remote attackers to determine the physical path to the root directory via a URL request containing a ":" character. |
| CVE-2000-0622 | High | 2000-07-19 | Not applicable | Working exploit published | Buffer overflow in Webfind CGI program in O'Reilly WebSite Professional web server 2.x allows remote attackers to execute arbitrary commands via a URL containing a long "keywords" parameter. |
| CVE-2000-0577 | High | 2000-06-21 | Not applicable | Working exploit published | Netscape Professional Services FTP Server 1.3.6 allows remote attackers to read arbitrary files via a .. (dot dot) attack. |