Overview 29 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 7 public PoC · 1 EPSS ≥ 0.5
29matches
1in Waratek scope3.4%
1protected3.4%
0exploited0.0%
0CISA KEV0.0%
7public PoC24.1%
1EPSS ≥ 0.53.4%
Protected by Waratek
1
3.4%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
28
96.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
3.4%
partly blocked
0
0.0%
not blocked
28
96.6%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
7
24.1%
Proof of concept only
0
0.0%
Forecast only
1
3.4%
No public exploit
21
72.4%
split by
peak 4 / year
20002
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20014
Not applicable4
High4
not blocked4
No public exploit4
20021
Not applicable1
High1
not blocked1
No public exploit1
20030
20040
20050
20063
Not applicable3
High3
not blocked3
Working exploit published2
No public exploit1
20072
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20081
Not applicable1
High1
not blocked1
No public exploit1
20092
Not applicable2
High2
not blocked2
Working exploit published2
20101
Not applicable1
High1
not blocked1
Working exploit published1
20110
20120
20131
Not applicable1
High1
not blocked1
No public exploit1
20140
20152
Not applicable2
High2
not blocked2
No public exploit2
20161
Protected by Waratek1
High1
blocked by ARMR today1
Forecast only1
20170
20180
20190
20200
20211
Not applicable1
High1
not blocked1
No public exploit1
20224
Not applicable4
High4
not blocked4
No public exploit4
20230
20243
Not applicable3
High3
not blocked3
No public exploit3
20251
Not applicable1
High1
not blocked1
No public exploit1
200120042007201020132016201920222025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-9826 | High | 2025-09-15 | Not applicable | No public exploit | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. |
| CVE-2024-6881 | High | 2024-07-29 | Not applicable | No public exploit | Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session |
| CVE-2024-6124 | High | 2024-07-29 | Not applicable | No public exploit | Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session |
| CVE-2024-5142 | High | 2024-05-24 | Not applicable | No public exploit | Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser |
| CVE-2022-39019 | High | 2022-10-31 | Not applicable | No public exploit | Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server. |
| CVE-2022-39018 | High | 2022-10-31 | Not applicable | No public exploit | Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. |
| CVE-2022-39017 | High | 2022-10-31 | Not applicable | No public exploit | Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments. |
| CVE-2022-39016 | High | 2022-10-31 | Not applicable | No public exploit | Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. |
| CVE-2020-19047 | High | 2021-08-31 | Not applicable | No public exploit | Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?controller=system&action=admin_edit_act'. |
| CVE-2016-2510 | High | 2016-04-07 | Protected by Waratek | Forecast only | BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler. |
| CVE-2015-2243 | High | 2015-03-09 | Not applicable | No public exploit | Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php. |
| CVE-2015-2242 | High | 2015-03-09 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in Webshop hun 1.062S allow remote attackers to execute arbitrary SQL commands via the (1) termid or (2) nyelv_id parameter to index.php. |
| CVE-2013-1898 | High | 2013-04-09 | Not applicable | No public exploit | lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. |
| CVE-2010-2031 | High | 2010-05-24 | Not applicable | Working exploit published | KAVSafe.sys 2010.4.14.609 and earlier, as used in Kingsoft Webshield 3.5.1.2 and earlier, allows local users to overwrite arbitrary kernel memory via a crafted request to IOCTL 0x830020d4 on the KAVSafe device. |
| CVE-2008-6627 | High | 2009-04-06 | Not applicable | Working exploit published | SQL injection vulnerability in getin.php in WEBBDOMAIN WebShop 1.2, 1.1, 1.02, and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. |
| CVE-2008-6268 | High | 2009-02-25 | Not applicable | Working exploit published | SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2007-6711 | High | 2008-03-24 | Not applicable | No public exploit | Unspecified vulnerability in customer.php in FreeWebshop.org 2.2.5, 2.2.6 and 2.2.7WIP1/2 allows remote attackers to gain administrator privileges via unknown vectors. |
| CVE-2007-6466 | High | 2007-12-20 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected. |
| CVE-2007-0531 | High | 2007-01-26 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in includes/login.php in FreeWebShop 2.2.3 and 2.2.4 before 20070123 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter. |
| CVE-2006-5772 | High | 2006-11-06 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) password and (2) prod parameter. |
| CVE-2006-1685 | High | 2006-04-11 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allow remote attackers to execute arbitrary SQL commands via the (1) group, (2) seite, and (3) id parameter, possibly involving the artikel functionality. NOTE: this vulnerability also allows resultant path disclosure when the SQL queries are invalid. |
| CVE-2006-0559 | High | 2006-04-04 | Not applicable | No public exploit | Format string vulnerability in the SMTP server for McAfee WebShield 4.5 MR2 and earlier allows remote attackers to execute arbitrary code via format strings in the domain name portion of a destination address, which are not properly handled when a bounce message is constructed. |
| CVE-2002-1121 | High | 2002-09-24 | Not applicable | No public exploit | SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3) the default configuration of MIMEDefang before 2.21, and possibly other products, do not detect fragmented emails as defined in RFC2046 ("Message Fragmentation and Reassembly") and supported in such products as Outlook Express, which allows remote attackers to bypass content filtering, including virus checking, via fragmented emails of the message/partial content type. |
| CVE-2001-1542 | High | 2001-12-31 | Not applicable | No public exploit | NAI WebShield SMTP 4.5 and possibly 4.5 MR1a does not filter improperly MIME encoded email attachments, which could allow remote attackers to bypass filtering and possibly execute arbitrary code in email clients that process the invalid attachments. |
| CVE-2001-1456 | High | 2001-09-04 | Not applicable | No public exploit | Buffer overflow in the (1) smap/smapd and (2) CSMAP daemons for Gauntlet Firewall 5.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted mail message. |
| CVE-2001-1229 | High | 2001-03-12 | Not applicable | No public exploit | Buffer overflows in (1) Icecast before 1.3.9 and (2) libshout before 1.0.4 allow remote attackers to cause a denial of service (crash) and execute arbitrary code. |
| CVE-2000-1130 | High | 2001-01-09 | Not applicable | No public exploit | McAfee WebShield SMTP 4.5 allows remote attackers to bypass email content filtering rules by including Extended ASCII characters in name of the attachment. |
| CVE-2000-0437 | High | 2000-05-18 | Not applicable | Working exploit published | Buffer overflow in the CyberPatrol daemon "cyberdaemon" used in gauntlet and WebShield allows remote attackers to cause a denial of service or execute arbitrary commands. |
| CVE-2000-0447 | High | 2000-05-01 | Not applicable | No public exploit | Buffer overflow in WebShield SMTP 4.5.44 allows remote attackers to execute arbitrary commands via a long configuration parameter to the WebShield remote management service. |