WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product mcms✕Has a public PoC✕
Overview 23 matches · 0 in Waratek scope · 0 protected · 5 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
23matches 0in Waratek scope0.0% 0protected0.0% 5exploited21.7% 0CISA KEV0.0% 3EPSS ≥ 0.513.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 6 26.1% Not applicable 17 73.9% Withdrawn CVE 0 0.0%
Critical 13 56.5% High 6 26.1% Medium 4 17.4% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 23 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 5 21.7% Working exploit published 17 73.9% Proof of concept only 1 4.3% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 12 / year
Not applicable: 17Outside Waratek scope: 6 Medium: 4High: 6Critical: 13 not blocked: 23 Proof of concept only: 1Working exploit published: 17Exploited: 5
20071 Not applicable1 High1 not blocked1 Working exploit published1 20084 Not applicable4 High4 not blocked4 Working exploit published4 20090 20100 20110 20120 20130 20141 Not applicable1 High1 not blocked1 Working exploit published1 20150 20160 20170 20182 Not applicable2 Medium2 not blocked2 Working exploit published1 Proof of concept only1 20190 20201 Not applicable1 Critical1 not blocked1 Exploited1 20210 202212 Outside Waratek scope4 Not applicable8 Critical11 Medium1 not blocked12 Exploited4 Working exploit published8 20232 Outside Waratek scope2 Critical1 Medium1 not blocked2 Working exploit published2
200720092011201320152017201920212023
23 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-50578 Critical 2023-12-30 Outside Waratek scope Working exploit published Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
CVE-2023-3990 Medium 2023-07-28 Outside Waratek scope Working exploit published A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
CVE-2022-4375 Critical 2022-12-09 Outside Waratek scope Working exploit published A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.
CVE-2022-30047 Critical 2022-05-11 Not applicable Exploited Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter.
CVE-2022-28033 Critical 2022-04-12 Not applicable Working exploit published Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php
CVE-2022-28032 Critical 2022-04-12 Not applicable Working exploit published AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php
CVE-2022-26585 Critical 2022-04-05 Outside Waratek scope Working exploit published Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
CVE-2022-25489 Medium 2022-03-15 Not applicable Working exploit published Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php.
CVE-2022-25488 Critical 2022-03-15 Not applicable Exploited Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.
CVE-2022-25487 Critical 2022-03-15 Not applicable Exploited Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
CVE-2022-25125 Critical 2022-03-03 Not applicable Working exploit published MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
CVE-2022-23898 Critical 2022-03-03 Outside Waratek scope Working exploit published MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
CVE-2021-44868 Critical 2022-02-17 Outside Waratek scope Exploited A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do
CVE-2022-24223 Critical 2022-02-01 Not applicable Working exploit published AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.
CVE-2020-29597 Critical 2020-12-07 Not applicable Exploited IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attackers to upload files into the server.
CVE-2018-8078 Medium 2018-03-13 Not applicable Proof of concept only YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html.
CVE-2018-7653 Medium 2018-03-04 Not applicable Working exploit published In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.
CVE-2014-4852 High 2014-07-10 Not applicable Working exploit published SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-5708 High 2008-12-24 Not applicable Working exploit published redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the newusername and newpassword parameters and setting the newisadmin parameter to 1.
CVE-2008-5491 High 2008-12-12 Not applicable Working exploit published SQL injection vulnerability in edit.php in SlimCMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pageID parameter.
CVE-2008-3721 High 2008-08-20 Not applicable Working exploit published PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.
CVE-2008-3720 High 2008-08-20 Not applicable Working exploit published SQL injection vulnerability in index.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the id vector is already covered by CVE-2007-5679.
CVE-2007-5679 High 2007-10-25 Not applicable Working exploit published SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in the media page (build_media_content.php). NOTE: it was later reported that 0.7.4 is also affected.