Overview 9 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
9matches
1in Waratek scope11.1%
1protected11.1%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
11.1%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
8
88.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
11.1%
partly blocked
0
0.0%
not blocked
8
88.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
2
22.2%
Forecast only
0
0.0%
No public exploit
7
77.8%
split by
peak 3 / year
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20150
20160
20170
20181
Not applicable1
Medium1
not blocked1
No public exploit1
20190
20200
20210
20221
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20233
Not applicable3
Medium3
not blocked3
No public exploit3
20242
Not applicable2
Medium2
not blocked2
Proof of concept only1
No public exploit1
20251
Not applicable1
Medium1
not blocked1
Proof of concept only1
201420152016201720182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-48906 | Medium | 2025-05-01 | Not applicable | Proof of concept only | Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name. |
| CVE-2024-44085 | Medium | 2024-09-09 | Not applicable | Proof of concept only | ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883. |
| CVE-2024-37447 | Medium | 2024-07-21 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 9.6.1.1. |
| CVE-2023-24391 | Medium | 2023-08-10 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline plugin <= 2.5 versions. |
| CVE-2023-2584 | Medium | 2023-06-09 | Not applicable | No public exploit | The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
| CVE-2023-22700 | Medium | 2023-03-13 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions. |
| CVE-2021-41042 | Medium | 2022-07-07 | Protected by Waratek | No public exploit | In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved. |
| CVE-2018-0578 | Medium | 2018-05-14 | Not applicable | No public exploit | Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2014-3750 | Medium | 2014-05-16 | Not applicable | No public exploit | The Bilyoner application before 2.3.1 for Android and before 4.6.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |