WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product jspwiki✕
Overview 9 matches · 4 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
9matches 4in Waratek scope44.4% 1protected11.1% 0exploited0.0% 0CISA KEV0.0% 2public PoC22.2% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 11.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 33.3% Outside Waratek scope 0 0.0% Not applicable 5 55.6% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 9 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 11.1% partly blocked 0 0.0% not blocked 8 88.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 22.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 77.8%
split by peak 3 / year
Not applicable: 5No exploit published: 3Protected by Waratek: 1 High: 9 not blocked: 8blocked by ARMR today: 1 No public exploit: 7Working exploit published: 2
20082 Not applicable2 High2 not blocked2 Working exploit published2 20090 20100 20110 20120 20130 20140 20150 20160 20170 20180 20191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20200 20210 20222 No exploit published2 High2 not blocked2 No public exploit2 20230 20240 20251 No exploit published1 High1 not blocked1 No public exploit1 20263 Not applicable3 High3 not blocked3 No public exploit3
2008201020122014201620182020202220242026
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-28814 High 2026-07-30 Not applicable No public exploit Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.
CVE-2026-28813 High 2026-07-30 Not applicable No public exploit Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
CVE-2026-28811 High 2026-07-30 Not applicable No public exploit Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
CVE-2025-24853 High 2025-07-31 No exploit published No public exploit A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too. Apache JSPWiki users should upgrade to 2.12.3 or later.
CVE-2022-34158 High 2022-08-04 No exploit published No public exploit A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.
CVE-2022-24947 High 2022-02-25 No exploit published No public exploit Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
CVE-2019-0225 High 2019-03-28 Protected by Waratek No public exploit A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
CVE-2008-1231 High 2008-03-10 Not applicable Working exploit published Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local .jsp files, and obtain sensitive information, via a .. (dot dot) in the editor parameter.
CVE-2008-1230 High 2008-03-10 Not applicable Working exploit published Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."