WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ccm✕
Overview 24 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
24matches 0in Waratek scope0.0% 0protected0.0% 1exploited4.2% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 24 100.0% Withdrawn CVE 0 0.0%
Critical 24 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 24 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 4.2% Working exploit published 0 0.0% Proof of concept only 9 37.5% Forecast only 0 0.0% No public exploit 14 58.3%
split by peak 6 / year
Not applicable: 24 Critical: 24 not blocked: 24 No public exploit: 14Proof of concept only: 9Exploited: 1
20161 Not applicable1 Critical1 not blocked1 No public exploit1 20171 Not applicable1 Critical1 not blocked1 Exploited1 20182 Not applicable2 Critical2 not blocked2 No public exploit2 20191 Not applicable1 Critical1 not blocked1 No public exploit1 20201 Not applicable1 Critical1 not blocked1 No public exploit1 20214 Not applicable4 Critical4 not blocked4 No public exploit4 20223 Not applicable3 Critical3 not blocked3 No public exploit3 20236 Not applicable6 Critical6 not blocked6 Proof of concept only4 No public exploit2 20240 20255 Not applicable5 Critical5 not blocked5 Proof of concept only5
2016201720182019202020212022202320242025
24 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-65836 Critical 2025-12-01 Not applicable Proof of concept only PublicCMS V5.202506.b is vulnerable to SSRF. in the chat interface of SimpleAiAdminController.
CVE-2025-28091 Critical 2025-03-28 Not applicable Proof of concept only maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
CVE-2025-28090 Critical 2025-03-28 Not applicable Proof of concept only maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
CVE-2025-28089 Critical 2025-03-28 Not applicable Proof of concept only maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
CVE-2025-25361 Critical 2025-03-06 Not applicable Proof of concept only An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.
CVE-2023-46990 Critical 2023-11-20 Not applicable No public exploit Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
CVE-2023-34852 Critical 2023-06-15 Not applicable Proof of concept only PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.
CVE-2023-26781 Critical 2023-04-28 Not applicable Proof of concept only SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
CVE-2020-20915 Critical 2023-04-04 Not applicable Proof of concept only SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl.
CVE-2020-20914 Critical 2023-04-04 Not applicable Proof of concept only SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.
CVE-2022-4126 Critical 2023-03-27 Not applicable No public exploit Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207.
CVE-2021-27693 Critical 2022-09-02 Not applicable No public exploit Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.
CVE-2021-45786 Critical 2022-03-16 Not applicable No public exploit In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.
CVE-2022-23389 Critical 2022-02-14 Not applicable No public exploit PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.
CVE-2021-40881 Critical 2021-09-15 Not applicable No public exploit An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.
CVE-2020-21359 Critical 2021-08-11 Not applicable No public exploit An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.
CVE-2020-20289 Critical 2021-02-01 Not applicable No public exploit Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters, triggers a sql injection vulnerability.
CVE-2020-20287 Critical 2021-02-01 Not applicable No public exploit Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution.
CVE-2020-10511 Critical 2020-04-15 Not applicable No public exploit HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit these flaws to access unauthorized functionality via a crafted URL.
CVE-2019-16192 Critical 2019-09-09 Not applicable No public exploit upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.
CVE-2018-18835 Critical 2018-10-30 Not applicable No public exploit upload_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file.
CVE-2018-12914 Critical 2018-06-27 Not applicable No public exploit A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI.
CVE-2017-17733 Critical 2017-12-18 Not applicable Exploited Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
CVE-2016-9155 Critical 2016-11-22 Not applicable No public exploit The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances.