WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ignite✕
Overview 20 matches · 2 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
20matches 2in Waratek scope10.0% 1protected5.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC5.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 5.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 5.0% Outside Waratek scope 0 0.0% Not applicable 18 90.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 20 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 5.0% partly blocked 0 0.0% not blocked 19 95.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 5.0% Proof of concept only 5 25.0% Forecast only 0 0.0% No public exploit 14 70.0%
split by peak 3 / year
Not applicable: 18No exploit published: 1Protected by Waratek: 1 High: 20 not blocked: 19blocked by ARMR today: 1 No public exploit: 14Proof of concept only: 5Working exploit published: 1
20041 Not applicable1 High1 not blocked1 No public exploit1 20050 20060 20070 20080 20091 Not applicable1 High1 not blocked1 Working exploit published1 20100 20110 20120 20130 20140 20150 20160 20172 No exploit published1 Not applicable1 High2 not blocked2 No public exploit2 20181 Not applicable1 High1 not blocked1 No public exploit1 20193 Not applicable3 High3 not blocked3 No public exploit3 20201 Not applicable1 High1 not blocked1 No public exploit1 20211 Not applicable1 High1 not blocked1 No public exploit1 20223 Not applicable3 High3 not blocked3 Proof of concept only1 No public exploit2 20231 Not applicable1 High1 not blocked1 No public exploit1 20243 Not applicable3 High3 not blocked3 Proof of concept only3 20252 Not applicable2 High2 not blocked2 Proof of concept only1 No public exploit1 20261 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
200420062008201020122014201620182020202220242026
20 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-48977 High 2026-05-28 Protected by Waratek No public exploit Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way. This issue affects Apache Ignite: from 2.0.0 through 2.17.0. Users are recommended to upgrade to version 2.18.0, which fixes the issue.
CVE-2025-61417 High 2025-10-20 Not applicable Proof of concept only Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to perform unauthorized actions such as modifying the admin account credentials.
CVE-2024-44313 High 2025-03-18 Not applicable No public exploit TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks.
CVE-2024-41344 High 2024-10-15 Not applicable Proof of concept only A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges.
CVE-2024-31821 High 2024-04-29 Not applicable Proof of concept only SQL Injection vulnerability in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the manageQuantitiesAndProcurement method of the Orders_model.php component.
CVE-2024-29904 High 2024-03-29 Not applicable Proof of concept only CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later.
CVE-2023-46240 High 2023-10-31 Not applicable No public exploit CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.
CVE-2022-23556 High 2022-12-22 Not applicable No public exploit CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.
CVE-2022-35943 High 2022-08-12 Not applicable Proof of concept only Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)
CVE-2022-24712 High 2022-02-28 Not applicable No public exploit CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for this vulnerability, but users will still need to code as these after upgrading to v4.1.9. Otherwise, the CSRF protection may be bypassed. If auto-routing is enabled, check the request method in the controller method before processing. If auto-routing is disabled, either avoid using `$routes->add()` and instead use HTTP verbs in routes; or check the request method in the controller method before processing.
CVE-2020-18694 High 2021-08-06 Not applicable No public exploit Cross Site Request Forgery (CSRF) in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profile/save_profile".
CVE-2020-10793 High 2020-03-23 Not applicable No public exploit CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself.
CVE-2019-17237 High 2019-11-12 Not applicable No public exploit includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.
CVE-2019-17234 High 2019-11-12 Not applicable No public exploit includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
CVE-2019-13370 High 2019-07-06 Not applicable No public exploit index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.
CVE-2016-10552 High 2018-05-31 Not applicable No public exploit igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.
CVE-2017-1000247 High 2017-11-17 Not applicable No public exploit British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws.
CVE-2017-7686 High 2017-06-28 No exploit published No public exploit Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.
CVE-2008-6182 High 2009-02-19 Not applicable Working exploit published SQL injection vulnerability in the Ignite Gallery (com_ignitegallery) component 0.8.0 through 0.8.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gallery parameter in a view action to index.php.
CVE-2004-0951 High 2004-12-31 Not applicable No public exploit The make_recovery command for the TFTP server in HP Ignite-UX before C.6.2.241 makes a copy of the password file in the TFTP directory tree, which allows remote attackers to obtain sensitive information.