Overview 33 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
33matches
1in Waratek scope3.0%
1protected3.0%
0exploited0.0%
0CISA KEV0.0%
2public PoC6.1%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
3.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
32
97.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
3.0%
partly blocked
0
0.0%
not blocked
32
97.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
3.0%
Proof of concept only
4
12.1%
Forecast only
0
0.0%
No public exploit
28
84.8%
split by
peak 9 / year
20073
Not applicable3
Medium3
not blocked3
No public exploit3
20080
20090
20100
20111
Not applicable1
Medium1
not blocked1
No public exploit1
20120
20130
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20150
20160
20171
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20182
Not applicable2
Medium2
not blocked2
No public exploit2
20192
Not applicable2
Medium2
not blocked2
No public exploit2
20209
Not applicable9
Medium9
not blocked9
Working exploit published1
No public exploit8
20212
Not applicable2
Medium2
not blocked2
Proof of concept only1
No public exploit1
20228
Not applicable8
Medium8
not blocked8
Proof of concept only1
No public exploit7
20231
Not applicable1
Medium1
not blocked1
Proof of concept only1
20241
Not applicable1
Medium1
not blocked1
Proof of concept only1
20252
Not applicable2
Medium2
not blocked2
No public exploit2
2007200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-44314 | Medium | 2025-03-18 | Not applicable | No public exploit | TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which fails to verify if the user has permission to modify an order's status. This flaw can be exploited remotely, leading to unauthorized order manipulation. |
| CVE-2025-24013 | Medium | 2025-01-20 | Not applicable | No public exploit | CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8. |
| CVE-2024-6526 | Medium | 2024-07-05 | Not applicable | Proof of concept only | A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 1b3da45308bb6c3f55247d0e99620b600bd85277. It is recommended to apply a patch to fix this issue. The identifier VDB-270369 was assigned to this vulnerability. |
| CVE-2023-23010 | Medium | 2023-01-20 | Not applicable | Proof of concept only | Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php. |
| CVE-2022-39284 | Medium | 2022-10-06 | Not applicable | Proof of concept only | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA. |
| CVE-2022-38256 | Medium | 2022-09-08 | Not applicable | No public exploit | TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2022-35213 | Medium | 2022-08-18 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function base_url() at /blog/blogpublish.php. |
| CVE-2022-0898 | Medium | 2022-05-09 | Not applicable | No public exploit | The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues |
| CVE-2022-26624 | Medium | 2022-04-08 | Not applicable | No public exploit | Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/add_product.php. |
| CVE-2022-0602 | Medium | 2022-04-05 | Not applicable | No public exploit | Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0. |
| CVE-2022-23378 | Medium | 2022-02-09 | Not applicable | No public exploit | A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable. |
| CVE-2022-21715 | Medium | 2022-01-24 | Not applicable | No public exploit | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only. |
| CVE-2021-40975 | Medium | 2021-10-01 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codeigniter 3.1.11, Bootstrap 3.3.7) allows remote attackers to inject arbitrary web script or HTML via the search_title parameter. |
| CVE-2021-38699 | Medium | 2021-08-15 | Not applicable | Proof of concept only | TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs. |
| CVE-2020-25093 | Medium | 2020-09-03 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage, and application/views/templates/redlabel. |
| CVE-2020-25092 | Medium | 2020-09-03 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, application/views/templates/greenlabel, and application/views/templates/redlabel. |
| CVE-2020-25091 | Medium | 2020-09-03 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php. |
| CVE-2020-25090 | Medium | 2020-09-03 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php. |
| CVE-2020-25089 | Medium | 2020-09-03 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php. |
| CVE-2020-25088 | Medium | 2020-09-03 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php. |
| CVE-2020-25087 | Medium | 2020-09-03 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php. |
| CVE-2020-25086 | Medium | 2020-09-03 | Not applicable | No public exploit | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php. |
| CVE-2012-1915 | Medium | 2020-01-09 | Not applicable | Working exploit published | EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks. |
| CVE-2019-17236 | Medium | 2019-11-12 | Not applicable | No public exploit | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. |
| CVE-2019-17235 | Medium | 2019-11-12 | Not applicable | No public exploit | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure. |
| CVE-2018-15203 | Medium | 2018-08-08 | Not applicable | No public exploit | An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/add_page allows a CSRF attack to add pages. |
| CVE-2013-4891 | Medium | 2018-02-21 | Not applicable | No public exploit | The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an unclosed HTML tag. |
| CVE-2016-6805 | Medium | 2017-04-07 | Protected by Waratek | No public exploit | Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents. |
| CVE-2014-6951 | Medium | 2014-10-15 | Not applicable | No public exploit | The OneFile Ignite (aka uk.co.onefile.ignite) application 1.19 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2011-3719 | Medium | 2011-09-23 | Not applicable | No public exploit | CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/scaffolding/views/view.php and certain other files. |
| CVE-2007-3709 | Medium | 2007-07-11 | Not applicable | No public exploit | CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in an unspecified parameter, as demonstrated by a Set-Cookie header. |
| CVE-2007-3708 | Medium | 2007-07-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCharCode and (2) malformed nested tag manipulations in an unspecified component, related to insufficient sanitization by the xss_clean function. |
| CVE-2007-3707 | Medium | 2007-07-11 | Not applicable | No public exploit | Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read arbitrary files via a .. (dot dot) in the c parameter. |