Overview 11 matches · 3 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
11matches
3in Waratek scope27.3%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
27.3%
Outside Waratek scope
0
0.0%
Not applicable
8
72.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
11
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
11
100.0%
split by
peak 4 / quarter
Q3 214
Not applicable4
Medium4
not blocked4
No public exploit4
Q4 210
Q1 221
Not applicable1
Medium1
not blocked1
No public exploit1
Q2 223
No exploit published2
Not applicable1
Medium3
not blocked3
No public exploit3
Q3 221
No exploit published1
Medium1
not blocked1
No public exploit1
Q4 220
Q1 231
Not applicable1
Medium1
not blocked1
No public exploit1
Q2 231
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22Q1 23Q2 23
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-24747 | Medium | 2023-04-05 | Not applicable | No public exploit | Jfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list. |
| CVE-2023-22975 | Medium | 2023-02-03 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html. |
| CVE-2022-36527 | Medium | 2022-08-25 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module. |
| CVE-2022-33113 | Medium | 2022-06-23 | No exploit published | No public exploit | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module. |
| CVE-2022-29648 | Medium | 2022-06-02 | No exploit published | No public exploit | A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request. |
| CVE-2022-27111 | Medium | 2022-04-11 | Not applicable | No public exploit | Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it. |
| CVE-2021-46087 | Medium | 2022-01-25 | Not applicable | No public exploit | In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code. |
| CVE-2020-19154 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'. |
| CVE-2020-19148 | Medium | 2021-09-15 | Not applicable | No public exploit | Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/jfinal_cms/front/person/profile.html'. |
| CVE-2020-19147 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'. |
| CVE-2020-19146 | Medium | 2021-09-15 | Not applicable | No public exploit | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'. |