Overview 81 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 8 public PoC · 0 EPSS ≥ 0.5
81matches
1in Waratek scope1.2%
1protected1.2%
0exploited0.0%
0CISA KEV0.0%
8public PoC9.9%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
1.2%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
80
98.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.2%
partly blocked
0
0.0%
not blocked
80
98.8%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
8
9.9%
Proof of concept only
43
53.1%
Forecast only
0
0.0%
No public exploit
30
37.0%
split by
peak 43 / year
20041
Not applicable1
High1
not blocked1
No public exploit1
20050
20061
Not applicable1
High1
not blocked1
Working exploit published1
20070
20085
Not applicable5
High5
not blocked5
Working exploit published4
No public exploit1
20091
Not applicable1
High1
not blocked1
Working exploit published1
20100
20110
20121
Not applicable1
High1
not blocked1
Working exploit published1
20130
20141
Not applicable1
High1
not blocked1
No public exploit1
20150
20160
20170
20183
Protected by Waratek1
Not applicable2
High3
blocked by ARMR today1
not blocked2
Working exploit published1
No public exploit2
20191
Not applicable1
High1
not blocked1
No public exploit1
20204
Not applicable4
High4
not blocked4
No public exploit4
20215
Not applicable5
High5
not blocked5
No public exploit5
20223
Not applicable3
High3
not blocked3
No public exploit3
20237
Not applicable7
High7
not blocked7
Proof of concept only2
No public exploit5
202443
Not applicable43
High43
not blocked43
Proof of concept only36
No public exploit7
20254
Not applicable4
High4
not blocked4
Proof of concept only4
20261
Not applicable1
High1
not blocked1
Proof of concept only1
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-69437 | High | 2026-02-27 | Not applicable | Proof of concept only | PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be triggered, resulting in issues such as credential theft, arbitrary API execution, and other security concerns. This vulnerability affects all file upload endpoint, including /cmsTemplate/save, /file/doUpload, /cmsTemplate/doUpload, /file/doBatchUpload, /cmsWebFile/doUpload, etc. |
| CVE-2025-65840 | High | 2025-12-01 | Not applicable | Proof of concept only | PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminController. |
| CVE-2025-65838 | High | 2025-12-01 | Not applicable | Proof of concept only | PublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method. |
| CVE-2025-57516 | High | 2025-09-29 | Not applicable | Proof of concept only | OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file. |
| CVE-2025-45474 | High | 2025-05-29 | Not applicable | Proof of concept only | maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings. |
| CVE-2024-21938 | High | 2024-11-12 | Not applicable | No public exploit | Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
| CVE-2024-42523 | High | 2024-08-23 | Not applicable | Proof of concept only | publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData |
| CVE-2024-40552 | High | 2024-07-12 | Not applicable | No public exploit | PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java. |
| CVE-2024-40551 | High | 2024-07-12 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40550 | High | 2024-07-12 | Not applicable | No public exploit | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40549 | High | 2024-07-12 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40548 | High | 2024-07-12 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40546 | High | 2024-07-12 | Not applicable | Proof of concept only | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40545 | High | 2024-07-12 | Not applicable | No public exploit | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2024-40544 | High | 2024-07-12 | Not applicable | Proof of concept only | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit. |
| CVE-2024-40543 | High | 2024-07-12 | Not applicable | Proof of concept only | PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/ueditor?action=catchimage. |
| CVE-2024-40334 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3 |
| CVE-2024-40333 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=del&dataID=2 |
| CVE-2024-40332 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord |
| CVE-2024-40331 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup |
| CVE-2024-40329 | High | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup |
| CVE-2024-40039 | High | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del |
| CVE-2024-40037 | High | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=del |
| CVE-2024-40036 | High | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=add&nohrefStr=close |
| CVE-2024-40034 | High | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=del |
| CVE-2024-39023 | High | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=close |
| CVE-2024-39022 | High | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=deal |
| CVE-2024-39158 | High | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mudi=infoSet. |
| CVE-2024-39154 | High | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=del&dataType=word&dataTypeCN. |
| CVE-2024-36670 | High | 2024-06-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del |
| CVE-2024-36669 | High | 2024-06-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add. |
| CVE-2024-36668 | High | 2024-06-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=del |
| CVE-2024-36667 | High | 2024-06-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType_deal.php?mudi=add&nohrefStr=close |
| CVE-2024-36550 | High | 2024-06-04 | Not applicable | Proof of concept only | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close |
| CVE-2024-36549 | High | 2024-06-04 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close |
| CVE-2024-36548 | High | 2024-06-04 | Not applicable | Proof of concept only | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany_deal.php?mudi=del |
| CVE-2024-36547 | High | 2024-06-04 | Not applicable | Proof of concept only | idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=add |
| CVE-2024-35559 | High | 2024-05-22 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-35558 | High | 2024-05-22 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-35556 | High | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet. |
| CVE-2024-35553 | High | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=add&nohrefStr=close. |
| CVE-2024-35552 | High | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=del&dataType=logo&dataTypeCN. |
| CVE-2024-35108 | High | 2024-05-15 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN. |
| CVE-2024-35010 | High | 2024-05-14 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner_deal.php?mudi=del&dataType=&dataTypeCN=%E5%9B%BE%E7%89%87%E5%B9%BF%E5%91%8A&theme=cs&dataID=6. |
| CVE-2024-35009 | High | 2024-05-14 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&fieldName=state&fieldName2=state&tabName=banner&dataID=6. |
| CVE-2024-33830 | High | 2024-05-06 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache. |
| CVE-2024-32391 | High | 2024-04-19 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload. |
| CVE-2024-31759 | High | 2024-04-16 | Not applicable | Proof of concept only | An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function. |
| CVE-2023-46603 | High | 2023-10-23 | Not applicable | No public exploit | In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPrmg.cpp in libSampleICC.a. |
| CVE-2023-46602 | High | 2023-10-23 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in IccXML/IccLibXML/IccUtilXml.cpp in libIccXML.a. |
| CVE-2023-5029 | High | 2023-09-17 | Not applicable | No public exploit | A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239871. |
| CVE-2023-3236 | High | 2023-06-14 | Not applicable | No public exploit | A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231507. |
| CVE-2023-3235 | High | 2023-06-14 | Not applicable | No public exploit | A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function pic_api of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231506 is the identifier assigned to this vulnerability. |
| CVE-2023-29815 | High | 2023-04-28 | Not applicable | Proof of concept only | mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF). |
| CVE-2022-47872 | High | 2023-02-01 | Not applicable | No public exploit | A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injected into the Name parameter under the Interface address module. |
| CVE-2022-43517 | High | 2022-12-13 | Not applicable | No public exploit | A vulnerability has been identified in Simcenter STAR-CCM+ (All versions < V2306). The affected application improperly assigns file permissions to installation folders. This could allow a local attacker with an unprivileged account to override or modify the service executables and subsequently gain elevated privileges. |
| CVE-2022-27333 | High | 2022-03-21 | Not applicable | No public exploit | idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resulting in a reset of the CMS settings and data. |
| CVE-2022-24661 | High | 2022-03-08 | Not applicable | No public exploit | A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2022.1). The starview+.exe contains a memory corruption vulnerability while parsing specially crafted .SCE files. This could allow an attacker to execute code in the context of the current process. |
| CVE-2021-42024 | High | 2021-12-14 | Not applicable | No public exploit | A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < 2021.3.1). The starview+.exe application lacks proper validation of user-supplied data when parsing scene files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. |
| CVE-2020-21386 | High | 2021-10-04 | Not applicable | No public exploit | A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges. |
| CVE-2020-20514 | High | 2021-09-24 | Not applicable | No public exploit | A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users. |
| CVE-2021-25665 | High | 2021-09-14 | Not applicable | No public exploit | A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1). The starview+.exe application lacks proper validation of user-supplied data when parsing scene files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13700) |
| CVE-2020-20290 | High | 2021-02-01 | Not applicable | No public exploit | Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability. |
| CVE-2020-12320 | High | 2020-11-12 | Not applicable | No public exploit | Uncontrolled search path in Intel(R) SCS Add-on for Microsoft* SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2020-5374 | High | 2020-07-14 | Not applicable | No public exploit | Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded cryptographic key vulnerability. A remote unauthenticated attacker may exploit this vulnerability to gain access to the appliance data for remotely managed devices. |
| CVE-2020-5373 | High | 2020-07-14 | Not applicable | No public exploit | Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to retrieve the system inventory data of the managed device. |
| CVE-2020-10512 | High | 2020-04-15 | Not applicable | No public exploit | HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands. |
| CVE-2019-9829 | High | 2019-03-15 | Not applicable | No public exploit | Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates. |
| CVE-2018-12114 | High | 2018-06-14 | Not applicable | Working exploit published | Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts. |
| CVE-2018-11500 | High | 2018-05-26 | Not applicable | No public exploit | An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account. |
| CVE-2018-1000054 | High | 2018-02-09 | Protected by Waratek | No public exploit | Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks. |
| CVE-2013-7362 | High | 2014-04-10 | Not applicable | No public exploit | An unspecified RFC function in SAP CCMS Agent allows remote attackers to execute arbitrary commands via unknown vectors. |
| CVE-2011-5170 | High | 2012-09-15 | Not applicable | Working exploit published | Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code via a long track name in an m3u playlist. |
| CVE-2008-7069 | High | 2009-08-25 | Not applicable | Working exploit published | All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database configuration information, including credentials, via a direct request to accms.dat. |
| CVE-2008-5195 | High | 2008-11-21 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in SebracCMS (sbcms) 0.4 allow remote attackers to execute arbitrary SQL commands via (1) the recid parameter to cms/form/read.php, (2) the uname parameter to cms/index.php, and other unspecified vectors. |
| CVE-2008-4526 | High | 2008-10-09 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in CCMS 3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter to (1) index.php, (2) forums.php, (3) admin.php, (4) header.php, (5) pages/story.php and (6) pages/poll.php. |
| CVE-2008-1904 | High | 2008-04-22 | Not applicable | Working exploit published | Cicoandcico CcMail 1.0.1 and earlier does not verify that the this_cookie cookie corresponds to an authenticated session, which allows remote attackers to obtain access to the "admin area" via a modified this_cookie cookie. |
| CVE-2007-6703 | High | 2008-03-04 | Not applicable | No public exploit | Unspecified vulnerability in vdccm before 0.10.1 in SynCE (SynCE-dccm) might allow attackers to cause a denial of service via unspecified vectors. |
| CVE-2007-6658 | High | 2008-01-04 | Not applicable | Working exploit published | SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitrary SQL commands via the p parameter in the Console page. |
| CVE-2006-5304 | High | 2006-10-17 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in inc/settings.php in IncCMS Core 1.0.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter. |
| CVE-2004-1694 | High | 2004-09-21 | Not applicable | No public exploit | Symantec ON Command CCM 5.4.x and iCommand 3.0.x has four default usernames and passwords, one of which is hardcoded, which allows remote attackers to gain unauthorized access. |