Overview 57 matches · 21 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
57matches
21in Waratek scope36.8%
1protected1.8%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
1.8%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
20
35.1%
Outside Waratek scope
0
0.0%
Not applicable
36
63.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.8%
partly blocked
0
0.0%
not blocked
56
98.2%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
10
17.5%
Forecast only
0
0.0%
No public exploit
47
82.5%
split by
peak 20 / quarter
Q4 191
No exploit published1
High1
not blocked1
No public exploit1
Q1 200
Q2 200
Q3 200
Q4 200
Q1 210
Q2 210
Q3 214
Not applicable4
High4
not blocked4
No public exploit4
Q4 211
Not applicable1
High1
not blocked1
No public exploit1
Q1 220
Q2 222
Not applicable2
High2
not blocked2
No public exploit2
Q3 2220
Not applicable20
High20
not blocked20
Proof of concept only1
No public exploit19
Q4 222
Not applicable2
High2
not blocked2
Proof of concept only2
Q1 230
Q2 231
Not applicable1
High1
not blocked1
Proof of concept only1
Q3 230
Q4 2320
Protected by Waratek1
No exploit published19
High20
blocked by ARMR today1
not blocked19
No public exploit20
Q1 242
Not applicable2
High2
not blocked2
Proof of concept only2
Q2 240
Q3 241
Not applicable1
High1
not blocked1
Proof of concept only1
Q4 240
Q1 253
Not applicable3
High3
not blocked3
Proof of concept only3
Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-57775 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid. |
| CVE-2024-57770 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. |
| CVE-2024-57769 | High | 2025-01-16 | Not applicable | Proof of concept only | JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. |
| CVE-2024-40322 | High | 2024-07-16 | Not applicable | Proof of concept only | An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data |
| CVE-2024-2568 | High | 2024-03-17 | Not applicable | Proof of concept only | A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/div_data/delete?divId=9 of the component Custom Data Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257071. |
| CVE-2024-24375 | High | 2024-03-07 | Not applicable | Proof of concept only | SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. |
| CVE-2023-50449 | High | 2023-12-10 | Protected by Waratek | No public exploit | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. |
| CVE-2023-49448 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete. |
| CVE-2023-49447 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update. |
| CVE-2023-49446 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save. |
| CVE-2023-49398 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete. |
| CVE-2023-49397 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus. |
| CVE-2023-49396 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save. |
| CVE-2023-49395 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update. |
| CVE-2023-49383 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. |
| CVE-2023-49382 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete. |
| CVE-2023-49381 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update. |
| CVE-2023-49380 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete. |
| CVE-2023-49379 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save. |
| CVE-2023-49378 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save. |
| CVE-2023-49377 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update. |
| CVE-2023-49376 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete. |
| CVE-2023-49375 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update. |
| CVE-2023-49374 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update. |
| CVE-2023-49373 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete. |
| CVE-2023-49372 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save. |
| CVE-2023-34645 | High | 2023-06-16 | Not applicable | Proof of concept only | jfinal CMS 5.1.0 has an arbitrary file read vulnerability. |
| CVE-2022-37202 | High | 2022-10-26 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list |
| CVE-2022-37208 | High | 2022-10-13 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37209 | High | 2022-09-27 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37205 | High | 2022-09-20 | Not applicable | Proof of concept only | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. |
| CVE-2022-37207 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection |
| CVE-2022-37201 | High | 2022-09-15 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
| CVE-2022-38286 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. |
| CVE-2022-38285 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. |
| CVE-2022-38284 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. |
| CVE-2022-38283 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. |
| CVE-2022-38282 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. |
| CVE-2022-38281 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. |
| CVE-2022-38280 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. |
| CVE-2022-38279 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. |
| CVE-2022-38278 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. |
| CVE-2022-38277 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. |
| CVE-2022-38276 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. |
| CVE-2022-38275 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. |
| CVE-2022-38274 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. |
| CVE-2022-38273 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. |
| CVE-2022-38272 | High | 2022-09-09 | Not applicable | No public exploit | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. |
| CVE-2022-34928 | High | 2022-08-03 | Not applicable | No public exploit | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
| CVE-2022-33114 | High | 2022-06-23 | Not applicable | No public exploit | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. |
| CVE-2022-28505 | High | 2022-05-03 | Not applicable | No public exploit | Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java. |
| CVE-2021-37262 | High | 2021-12-16 | Not applicable | No public exploit | JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. |
| CVE-2021-40639 | High | 2021-09-15 | Not applicable | No public exploit | Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js. |
| CVE-2020-19155 | High | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileManager.rename()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19151 | High | 2021-09-15 | Not applicable | No public exploit | Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'. |
| CVE-2020-19150 | High | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2019-17352 | High | 2019-10-08 | No exploit published | No public exploit | In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions. |