Overview 23 matches · 11 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
23matches
11in Waratek scope47.8%
0protected0.0%
1exploited4.3%
0CISA KEV0.0%
1public PoC4.3%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
11
47.8%
Outside Waratek scope
0
0.0%
Not applicable
12
52.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
23
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
4.3%
Working exploit published
0
0.0%
Proof of concept only
14
60.9%
Forecast only
0
0.0%
No public exploit
8
34.8%
split by
peak 7 / month
Sep 231
Not applicable1
Medium1
not blocked1
Exploited1
Oct 230
Nov 230
Dec 237
No exploit published7
Medium7
not blocked7
No public exploit7
Jan 246
No exploit published4
Not applicable2
Medium6
not blocked6
Proof of concept only6
Feb 240
Mar 240
Apr 241
Not applicable1
Medium1
not blocked1
Proof of concept only1
May 242
Not applicable2
Medium2
not blocked2
Proof of concept only1
No public exploit1
Jun 240
Jul 240
Aug 240
Sep 243
Not applicable3
Medium3
not blocked3
Proof of concept only3
Oct 240
Nov 240
Dec 243
Not applicable3
Medium3
not blocked3
Proof of concept only3
Oct 23Dec 23Feb 24Apr 24Jun 24Aug 24Oct 24Dec 24
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-12351 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. |
| CVE-2024-12350 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the argument content leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-12349 | Medium | 2024-12-09 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tag/save. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-8782 | Medium | 2024-09-13 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-8706 | Medium | 2024-09-12 | Not applicable | Proof of concept only | A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-8694 | Medium | 2024-09-11 | Not applicable | Proof of concept only | A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-5379 | Medium | 2024-05-26 | Not applicable | No public exploit | A vulnerability was found in JFinalCMS up to 20240111. It has been rated as problematic. This issue affects some unknown processing of the file /admin/template. The manipulation of the argument directory leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266291. |
| CVE-2024-5310 | Medium | 2024-05-24 | Not applicable | Proof of concept only | A vulnerability classified as problematic has been found in JFinalCMS up to 20221020. This affects an unknown part of the file /admin/content. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266121 was assigned to this vulnerability. |
| CVE-2023-51254 | Medium | 2024-04-29 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component. |
| CVE-2024-22497 | Medium | 2024-01-23 | No exploit published | Proof of concept only | Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. |
| CVE-2024-22496 | Medium | 2024-01-23 | No exploit published | Proof of concept only | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. |
| CVE-2024-22494 | Medium | 2024-01-12 | Not applicable | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2024-22493 | Medium | 2024-01-12 | No exploit published | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2024-22492 | Medium | 2024-01-12 | No exploit published | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2023-50136 | Medium | 2024-01-09 | Not applicable | Proof of concept only | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. |
| CVE-2023-50137 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. |
| CVE-2023-50102 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). |
| CVE-2023-50101 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. |
| CVE-2023-50100 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. |
| CVE-2023-49487 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. |
| CVE-2023-49486 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. |
| CVE-2023-49485 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. |
| CVE-2023-41599 | Medium | 2023-09-19 | Not applicable | Exploited | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. |