Overview 25 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 13 public PoC · 0 EPSS ≥ 0.5
25matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
13public PoC52.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
25
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
25
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
13
52.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
12
48.0%
split by
peak 6 / year
20002
Not applicable2
Medium2
not blocked2
No public exploit2
20011
Not applicable1
Medium1
not blocked1
Working exploit published1
20021
Not applicable1
Medium1
not blocked1
No public exploit1
20030
20040
20050
20066
Not applicable6
Medium6
not blocked6
Working exploit published4
No public exploit2
20071
Not applicable1
Medium1
not blocked1
Working exploit published1
20081
Not applicable1
Medium1
not blocked1
Working exploit published1
20095
Not applicable5
Medium5
not blocked5
Working exploit published3
No public exploit2
20100
20110
20122
Not applicable2
Medium2
not blocked2
Working exploit published2
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20140
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20160
20170
20182
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20190
20200
20210
20221
Not applicable1
Medium1
not blocked1
No public exploit1
20230
20241
Not applicable1
Medium1
not blocked1
No public exploit1
2000200220042006200820102012201420162018202020222024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-9174 | Medium | 2024-10-02 | Not applicable | No public exploit | Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI |
| CVE-2022-1685 | Medium | 2022-06-08 | Not applicable | No public exploit | The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection |
| CVE-2012-6668 | Medium | 2018-01-11 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the (1) reportreason parameter in actions/doreport.php or (2) modnotes parameter in actions/updatereport.php. |
| CVE-2012-6667 | Medium | 2018-01-11 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web script or HTML via the shout parameter in a shout action. |
| CVE-2015-2244 | Medium | 2015-03-09 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Webshop hun 1.062S allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) center, (3) lap, (4) termid, or (5) nyelv_id parameter to index.php. |
| CVE-2013-0465 | Medium | 2013-02-22 | Not applicable | No public exploit | Unspecified vulnerability in the IBM WebSphere Cast Iron physical and virtual appliance 6.0 and 6.1 before 6.1.0.15 and 6.3 before 6.3.0.1, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors. |
| CVE-2011-5186 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject arbitrary web script or HTML via the item_id parameter. |
| CVE-2011-5147 | Medium | 2012-08-31 | Not applicable | Working exploit published | Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document, as demonstrated by a call to ajax_file_cut.php and then to ajax_save_name.php. |
| CVE-2009-3284 | Medium | 2009-09-22 | Not applicable | No public exploit | Directory traversal vulnerability in phpspot PHP BBS, PHP Image Capture BBS, PHP & CSS BBS, PHP BBS CE, PHP_RSS_Builder, and webshot, dated before 20090914, allows remote attackers to read arbitrary files via unspecified vectors. |
| CVE-2009-3283 | Medium | 2009-09-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in phpspot PHP BBS, PHP Image Capture BBS, PHP & CSS BBS, PHP BBS CE, PHP_RSS_Builder, and webshot, dated before 20090914, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to cookies. |
| CVE-2009-2338 | Medium | 2009-07-07 | Not applicable | Working exploit published | Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_file parameter. |
| CVE-2008-6629 | Medium | 2009-04-06 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary web script or HTML via the name parameter. |
| CVE-2008-6267 | Medium | 2009-02-25 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in detail.php in Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary web script or HTML via the name parameter. |
| CVE-2008-1541 | Medium | 2008-03-28 | Not applicable | Working exploit published | Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter. |
| CVE-2006-6941 | Medium | 2007-01-19 | Not applicable | Working exploit published | index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an info operation, which discloses the path in an error message. |
| CVE-2006-5847 | Medium | 2006-11-10 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat parameter. |
| CVE-2006-5846 | Medium | 2006-11-10 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to read and include arbitrary files via a .. (dot dot) in the page parameter, a different vector than CVE-2006-5773. |
| CVE-2006-5773 | Medium | 2006-11-06 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrary files and disclose the installation path via a .. (dot dot) in the action parameter. |
| CVE-2006-4945 | Medium | 2006-09-23 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in Cardway (aka Frederic Boudaud) DigitalWebShop 1.128 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the _PHPLIB[libdir] parameter to (1) rechnung.php or (2) prepend.php. |
| CVE-2006-1687 | Medium | 2006-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to inject arbitrary web script or HTML via the message parameter, probably involving the basket functionality. |
| CVE-2006-1686 | Medium | 2006-04-11 | Not applicable | No public exploit | Unspecified vulnerability in modules.php in APT-webshop-system 4.0 PRO, 3.0 BASIC, and 3.0 LIGHT allows remote attackers to access unspecified files via a modified warp parameter. |
| CVE-2002-2293 | Medium | 2002-12-31 | Not applicable | No public exploit | Webshots Desktop screensaver allows local users to bypass the password on the screensaver by pressing CTRL-ALT-DELETE and (1) hitting the cancel button or (2) killing the screensaver from the task manager. |
| CVE-2000-1129 | Medium | 2001-01-09 | Not applicable | Working exploit published | McAfee WebShield SMTP 4.5 allows remote attackers to cause a denial of service via a malformed recipient field. |
| CVE-2000-0738 | Medium | 2000-10-20 | Not applicable | No public exploit | WebShield SMTP 4.5 allows remote attackers to cause a denial of service by sending e-mail with a From: address that has a . (period) at the end, which causes WebShield to continuously send itself copies of the e-mail. |
| CVE-2000-0448 | Medium | 2000-05-01 | Not applicable | No public exploit | The WebShield SMTP Management Tool version 4.5.44 does not properly restrict access to the management port when an IP address does not resolve to a hostname, which allows remote attackers to access the configuration via the GET_CONFIG command. |