Overview 78 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
78matches
0in Waratek scope0.0%
0protected0.0%
1exploited1.3%
0CISA KEV0.0%
2public PoC2.6%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
78
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
78
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 32 / year
20071
Not applicable1
Medium1
not blocked1
Working exploit published1
20080
20090
20100
20110
20120
20130
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20150
20160
20170
20184
Not applicable4
Medium4
not blocked4
No public exploit4
20192
Not applicable2
Medium2
not blocked2
No public exploit2
20200
20217
Not applicable7
Medium7
not blocked7
No public exploit7
202214
Not applicable14
Medium14
not blocked14
No public exploit14
20237
Not applicable7
Medium7
not blocked7
Proof of concept only7
202432
Not applicable32
Medium32
not blocked32
Exploited1
Proof of concept only29
No public exploit2
20259
Not applicable9
Medium9
not blocked9
Proof of concept only7
No public exploit2
20261
Not applicable1
Medium1
not blocked1
No public exploit1
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-40745 | Medium | 2026-04-14 | Not applicable | No public exploit | A vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Simcenter STAR-CCM+ (All versions < V2602), Solid Edge SE2025 (All versions < V225.0 Update 13), Solid Edge SE2026 (All versions < V226.0 Update 04), Tecnomatix Plant Simulation (All versions < V2504.0008). Affected applications do not properly validate client certificates to connect to Analytics Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks. |
| CVE-2025-65837 | Medium | 2025-12-22 | Not applicable | Proof of concept only | PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. |
| CVE-2025-64048 | Medium | 2025-11-24 | Not applicable | No public exploit | YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field. |
| CVE-2025-10395 | Medium | 2025-09-14 | Not applicable | No public exploit | A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely. |
| CVE-2025-51818 | Medium | 2025-08-21 | Not applicable | Proof of concept only | MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands |
| CVE-2025-50234 | Medium | 2025-08-06 | Not applicable | Proof of concept only | MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key (bD2voYwPpNuJ7B8), defined in the db.php file. The decrypted URL is passed to the geturl() method, which uses cURL to make a request to the URL without proper security checks. An attacker can craft a malicious encrypted pic parameter, which, when decrypted, points to internal addresses or local file paths (such as http://127.0.0.1 or file://). By using the file:// protocol, the attacker can access arbitrary files on the local file system (e.g., file:///etc/passwd, file:///C:/Windows/System32/drivers/etc/hosts), allowing them to read sensitive configuration files, log files, and more, leading to information leakage or system exposure. The danger of this SSRF vulnerability includes accessing internal services and local file systems through protocols like http://, ftp://, and file://, which can result in sensitive data leakage, remote code execution, privilege escalation, or full system compromise, severely affecting the system's security and stability. |
| CVE-2025-51651 | Medium | 2025-07-14 | Not applicable | Proof of concept only | An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request. |
| CVE-2025-5328 | Medium | 2025-05-29 | Not applicable | Proof of concept only | A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the argument dirs leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-5327 | Medium | 2025-05-29 | Not applicable | Proof of concept only | A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-45475 | Medium | 2025-05-27 | Not applicable | Proof of concept only | maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management. |
| CVE-2024-11587 | Medium | 2024-11-21 | Not applicable | Exploited | A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php. The manipulation of the argument idName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-11175 | Medium | 2024-11-13 | Not applicable | Proof of concept only | A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named b9530b9cc1f5cfdad4b637874f59029a6283a65c. It is recommended to apply a patch to fix this issue. |
| CVE-2024-11070 | Medium | 2024-11-11 | Not applicable | Proof of concept only | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-46410 | Medium | 2024-10-08 | Not applicable | Proof of concept only | PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature |
| CVE-2024-46654 | Medium | 2024-09-20 | Not applicable | Proof of concept only | A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2024-40547 | Medium | 2024-07-12 | Not applicable | Proof of concept only | PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace. |
| CVE-2024-40336 | Medium | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.' |
| CVE-2024-40328 | Medium | 2024-07-10 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6 |
| CVE-2024-40038 | Medium | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev |
| CVE-2024-40035 | Medium | 2024-07-09 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add. |
| CVE-2024-39021 | Medium | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData_deal.php?mudi=del |
| CVE-2024-39020 | Medium | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=close |
| CVE-2024-39019 | Medium | 2024-07-05 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData_deal.php?mudi=del |
| CVE-2024-39119 | Medium | 2024-07-02 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-39155 | Medium | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=add. |
| CVE-2024-39153 | Medium | 2024-06-27 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/info_deal.php?mudi=del&dataType=news&dataTypeCN. |
| CVE-2024-35561 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close. |
| CVE-2024-35560 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=del&dataType=&dataTypeCN. |
| CVE-2024-35557 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-35555 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=newsWeb&fieldName=state&fieldName2=state&tabName=infoWeb&dataID=40. |
| CVE-2024-35554 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN. |
| CVE-2024-35551 | Medium | 2024-05-22 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=add. |
| CVE-2024-35550 | Medium | 2024-05-22 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=rev. |
| CVE-2024-34958 | Medium | 2024-05-16 | Not applicable | No public exploit | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner_deal.php?mudi=add |
| CVE-2024-34957 | Medium | 2024-05-16 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages_deal.php?mudi=infoSet. |
| CVE-2024-35109 | Medium | 2024-05-15 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro_deal.php?mudi=add&nohrefStr=close. |
| CVE-2024-35012 | Medium | 2024-05-14 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=close. |
| CVE-2024-35011 | Medium | 2024-05-14 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close. |
| CVE-2024-33829 | Medium | 2024-05-06 | Not applicable | Proof of concept only | idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache. |
| CVE-2024-4172 | Medium | 2024-04-25 | Not applicable | Proof of concept only | A vulnerability classified as problematic was found in idcCMS 1.35. Affected by this vulnerability is an unknown functionality of the file /admin/admin_cl.php?mudi=revPwd. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261991. |
| CVE-2024-2911 | Medium | 2024-03-26 | Not applicable | Proof of concept only | A vulnerability, which was classified as problematic, was found in Tianjin PubliCMS 4.0.202302.e. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2023-51252 | Medium | 2024-01-10 | Not applicable | Proof of concept only | PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing. |
| CVE-2023-48736 | Medium | 2023-11-18 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read. |
| CVE-2023-48204 | Medium | 2023-11-16 | Not applicable | Proof of concept only | An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component. |
| CVE-2023-47249 | Medium | 2023-11-05 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function (for unsigned short) in IccUtilXml.cpp in libIccXML.a has an out-of-bounds read. |
| CVE-2023-46867 | Medium | 2023-10-30 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer dereference. |
| CVE-2023-46866 | Medium | 2023-10-30 | Not applicable | Proof of concept only | In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes. |
| CVE-2023-26782 | Medium | 2023-04-28 | Not applicable | Proof of concept only | An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters. |
| CVE-2022-44870 | Medium | 2023-01-06 | Not applicable | Proof of concept only | A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module. |
| CVE-2022-3950 | Medium | 2022-11-11 | Not applicable | No public exploit | A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component Tab Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a972dc9b1c94aea2d84478bf26283904c21e4ca2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213456. |
| CVE-2022-35148 | Medium | 2022-08-17 | Not applicable | No public exploit | maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html. |
| CVE-2022-34659 | Medium | 2022-08-10 | Not applicable | No public exploit | A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license server is used). Affected applications expose user, host and display name of users, when the public license server is used. This could allow an attacker to retrieve this information. |
| CVE-2022-31303 | Medium | 2022-06-21 | Not applicable | No public exploit | maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. |
| CVE-2022-31302 | Medium | 2022-06-21 | Not applicable | No public exploit | maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. |
| CVE-2022-26041 | Medium | 2022-06-13 | Not applicable | No public exploit | Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitrary file on the server via unspecified vectors. |
| CVE-2022-29784 | Medium | 2022-06-03 | Not applicable | No public exploit | PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java. |
| CVE-2021-43707 | Medium | 2022-03-31 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter. |
| CVE-2022-27887 | Medium | 2022-03-25 | Not applicable | No public exploit | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter. |
| CVE-2022-27886 | Medium | 2022-03-25 | Not applicable | No public exploit | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter. |
| CVE-2022-27885 | Medium | 2022-03-25 | Not applicable | No public exploit | Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters. |
| CVE-2022-27884 | Medium | 2022-03-25 | Not applicable | No public exploit | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter. |
| CVE-2022-26573 | Medium | 2022-03-25 | Not applicable | No public exploit | Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters. |
| CVE-2021-45787 | Medium | 2022-03-16 | Not applicable | No public exploit | There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks. |
| CVE-2020-21434 | Medium | 2021-10-04 | Not applicable | No public exploit | Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field. |
| CVE-2020-21387 | Medium | 2021-10-04 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload. |
| CVE-2020-21082 | Medium | 2021-09-14 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names. |
| CVE-2020-21081 | Medium | 2021-09-14 | Not applicable | No public exploit | A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL. |
| CVE-2020-21363 | Medium | 2021-08-11 | Not applicable | No public exploit | An arbitrary file deletion vulnerability exists within Maccms10. |
| CVE-2020-21362 | Medium | 2021-08-11 | Not applicable | No public exploit | A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter. |
| CVE-2020-21333 | Medium | 2021-07-09 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case. |
| CVE-2018-19465 | Medium | 2019-06-07 | Not applicable | No public exploit | Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, related to template/paody/html/vod_index.html. |
| CVE-2019-8410 | Medium | 2019-02-27 | Not applicable | No public exploit | Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key). |
| CVE-2018-18927 | Medium | 2018-11-04 | Not applicable | No public exploit | An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement. |
| CVE-2018-17368 | Medium | 2018-09-23 | Not applicable | No public exploit | An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, which makes it easier to conduct brute-force attacks. |
| CVE-2018-12494 | Medium | 2018-06-15 | Not applicable | No public exploit | An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsTemplate/content.html?path=../ URI. |
| CVE-2018-12493 | Medium | 2018-06-15 | Not applicable | No public exploit | An issue was discovered in PublicCMS V4.0.20180210. There is a "Directory Traversal" and "Arbitrary file read" vulnerability via an admin/cmsWebFile/list.html?path=../ URI. |
| CVE-2013-7356 | Medium | 2014-04-10 | Not applicable | No public exploit | Unspecified vulnerability in the SAP CCMS / Database Monitors for Oracle allows attackers to obtain the database password via unknown vectors. |
| CVE-2007-1516 | Medium | 2007-03-20 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the functions_dir parameter. |