WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product fields✕
Overview 11 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
11matches 0in Waratek scope0.0% 0protected0.0% 1exploited9.1% 0CISA KEV0.0% 1public PoC9.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 11 100.0% Withdrawn CVE 0 0.0%
Critical 11 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 9.1% Working exploit published 0 0.0% Proof of concept only 1 9.1% Forecast only 0 0.0% No public exploit 9 81.8%
split by peak 4 / year
Not applicable: 11 Critical: 11 not blocked: 11 No public exploit: 9Proof of concept only: 1Exploited: 1
20181 Not applicable1 Critical1 not blocked1 No public exploit1 20191 Not applicable1 Critical1 not blocked1 No public exploit1 20200 20210 20222 Not applicable2 Critical2 not blocked2 Exploited1 Proof of concept only1 20230 20244 Not applicable4 Critical4 not blocked4 No public exploit4 20251 Not applicable1 Critical1 not blocked1 No public exploit1 20262 Not applicable2 Critical2 not blocked2 No public exploit2
201820192020202120222023202420252026
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-48906 Critical 2026-05-27 Not applicable No public exploit The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
CVE-2026-23489 Critical 2026-03-16 Not applicable No public exploit Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
CVE-2024-13359 Critical 2025-03-08 Not applicable No public exploit The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make .php file uploads possible. Please note 1.12.2 was mistakenly marked as patched while 1.12.1 was marked as vulnerable for a short period of time, this is not the case and 1.12.1 is fully patched.
CVE-2024-11150 Critical 2024-11-13 Not applicable No public exploit The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_tmp_uploaded_file() function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVE-2024-35661 Critical 2024-06-09 Not applicable No public exploit Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.
CVE-2024-3962 Critical 2024-04-26 Not applicable No public exploit The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce.
CVE-2024-25845 Critical 2024-03-08 Not applicable No public exploit In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions.
CVE-2022-4117 Critical 2022-12-26 Not applicable Exploited The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.
CVE-2022-40842 Critical 2022-11-22 Not applicable Proof of concept only ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.
CVE-2019-12723 Critical 2019-07-10 Not applicable No public exploit An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.
CVE-2018-16281 Critical 2018-09-21 Not applicable No public exploit The DEISER "Profields - Project Custom Fields" app before 6.0.2 for Jira has Incorrect Access Control.