WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product jquery✕
Overview 16 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
16matches 0in Waratek scope0.0% 0protected0.0% 1exploited6.2% 0CISA KEV0.0% 2public PoC12.5% 1EPSS ≥ 0.56.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 6.2% Not applicable 15 93.8% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 16 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 16 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 6.2% Working exploit published 1 6.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 14 87.5%
split by peak 5 / year
Not applicable: 15Outside Waratek scope: 1 High: 16 not blocked: 16 No public exploit: 14Working exploit published: 1Exploited: 1
20171 Not applicable1 High1 not blocked1 Exploited1 20182 Not applicable2 High2 not blocked2 No public exploit2 20190 20200 20215 Outside Waratek scope1 Not applicable4 High5 not blocked5 Working exploit published1 No public exploit4 20224 Not applicable4 High4 not blocked4 No public exploit4 20232 Not applicable2 High2 not blocked2 No public exploit2 20241 Not applicable1 High1 not blocked1 No public exploit1 20251 Not applicable1 High1 not blocked1 No public exploit1
201720182019202020212022202320242025
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-28861 High 2025-03-11 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian Datepicker: from n/a through <= 0.1.0.
CVE-2024-24849 High 2024-02-21 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
CVE-2023-5464 High 2023-10-31 Not applicable No public exploit The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2023-5430 High 2023-10-31 Not applicable No public exploit The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2022-31147 High 2022-07-14 Not applicable No public exploit The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.
CVE-2021-43306 High 2022-06-02 Not applicable No public exploit An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
CVE-2022-24985 High 2022-02-16 Not applicable No public exploit Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server.
CVE-2022-24983 High 2022-02-16 Not applicable No public exploit Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained with CVE-2022-24984, this could lead to unauthenticated remote code execution on the underlying web server. This occurs because the Unique ID field is contained in the POST response upon submitting a form.
CVE-2021-20087 High 2021-04-23 Not applicable No public exploit Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties into Object.prototype.
CVE-2021-20086 High 2021-04-23 Not applicable Working exploit published Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
CVE-2021-20084 High 2021-04-23 Not applicable No public exploit Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype.
CVE-2021-20083 High 2021-04-23 Not applicable No public exploit Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.
CVE-2021-21252 High 2021-01-13 Outside Waratek scope No public exploit The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.
CVE-2017-16045 High 2018-06-04 Not applicable No public exploit `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2016-10707 High 2018-01-18 Not applicable No public exploit jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
CVE-2017-1000170 High 2017-11-17 Not applicable Exploited jqueryFileTree 2.1.5 and older Directory Traversal