Overview 25 matches · 19 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 5 EPSS ≥ 0.5
25matches
19in Waratek scope76.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
2public PoC8.0%
5EPSS ≥ 0.520.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
19
76.0%
Outside Waratek scope
0
0.0%
Not applicable
6
24.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
25
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
8.0%
Proof of concept only
0
0.0%
Forecast only
5
20.0%
No public exploit
18
72.0%
split by
peak 10 / year
20041
Not applicable1
Medium1
not blocked1
No public exploit1
20050
20060
20073
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20081
Not applicable1
Medium1
not blocked1
Working exploit published1
20090
20100
20110
20120
20130
20140
20150
20160
20170
20180
201910
No exploit published10
Medium10
not blocked10
No public exploit10
20200
20211
No exploit published1
Medium1
not blocked1
No public exploit1
20225
No exploit published5
Medium5
not blocked5
Forecast only4
No public exploit1
20231
No exploit published1
Medium1
not blocked1
No public exploit1
20241
No exploit published1
Medium1
not blocked1
Forecast only1
20251
No exploit published1
Medium1
not blocked1
No public exploit1
20261
Not applicable1
Medium1
not blocked1
No public exploit1
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-48910 | Medium | 2026-07-30 | Not applicable | No public exploit | A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue. |
| CVE-2025-24854 | Medium | 2025-07-31 | No exploit published | No public exploit | A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.3 or later. |
| CVE-2024-27136 | Medium | 2024-06-24 | No exploit published | Forecast only | XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later. |
| CVE-2022-46907 | Medium | 2023-05-25 | No exploit published | No public exploit | A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later. |
| CVE-2022-28732 | Medium | 2022-08-04 | No exploit published | Forecast only | A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later. |
| CVE-2022-28731 | Medium | 2022-08-04 | No exploit published | Forecast only | A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page. |
| CVE-2022-28730 | Medium | 2022-08-04 | No exploit published | Forecast only | A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later. |
| CVE-2022-27166 | Medium | 2022-08-04 | No exploit published | Forecast only | A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. |
| CVE-2022-24948 | Medium | 2022-02-25 | No exploit published | No public exploit | A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later. |
| CVE-2021-40369 | Medium | 2021-11-24 | No exploit published | No public exploit | A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later. |
| CVE-2019-12407 | Medium | 2019-09-23 | No exploit published | No public exploit | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. |
| CVE-2019-12404 | Medium | 2019-09-23 | No exploit published | No public exploit | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. |
| CVE-2019-10090 | Medium | 2019-09-23 | No exploit published | No public exploit | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. |
| CVE-2019-10089 | Medium | 2019-09-23 | No exploit published | No public exploit | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. |
| CVE-2019-10087 | Medium | 2019-09-23 | No exploit published | No public exploit | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. |
| CVE-2019-10078 | Medium | 2019-05-20 | No exploit published | No public exploit | A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable. |
| CVE-2019-10077 | Medium | 2019-05-20 | No exploit published | No public exploit | A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. |
| CVE-2019-10076 | Medium | 2019-05-20 | No exploit published | No public exploit | A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. |
| CVE-2019-0224 | Medium | 2019-03-28 | No exploit published | No public exploit | In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser. |
| CVE-2018-20242 | Medium | 2019-02-11 | No exploit published | No public exploit | A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking. |
| CVE-2008-1229 | Medium | 2008-03-10 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script or HTML via the editor parameter, a different vector than CVE-2007-5120.b. |
| CVE-2007-5121 | Medium | 2007-09-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in JSPWiki 2.5.139-beta allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to wiki-3/Login.jsp and unspecified other components. |
| CVE-2007-5120 | Medium | 2007-09-27 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject arbitrary web script or HTML via the (1) group and (2) members parameters in (a) NewGroup.jsp; the (3) edittime parameter in (b) Edit.jsp; the (4) edittime, (5) author, and (6) link parameters in (c) Comment.jsp; the (7) loginname, (8) wikiname, (9) fullname, and (10) email parameters in (d) UserPreferences.jsp and (e) Login.jsp; the (11) r1 and (12) r2 parameters in (f) Diff.jsp; and the (13) changenote parameter in (g) PageInfo.jsp. |
| CVE-2007-5119 | Medium | 2007-09-27 | Not applicable | No public exploit | JSPWiki 2.4.103 and 2.5.139-beta allows remote attackers to obtain sensitive information (full path) via an invalid integer in the version parameter to the default URI under attach/Main/. |
| CVE-2004-1544 | Medium | 2004-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Search.jsp in JSPWiki 2.1.120-cvs and earlier allows remote attackers to execute arbitrary web script as other users via the query parameter. |