Overview 65 matches · 0 in Waratek scope · 0 protected · 5 exploited · 0 CISA KEV · 13 public PoC · 3 EPSS ≥ 0.5
65matches
0in Waratek scope0.0%
0protected0.0%
5exploited7.7%
0CISA KEV0.0%
13public PoC20.0%
3EPSS ≥ 0.54.6%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
22
33.8%
Not applicable
43
66.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
65
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 41 / year
20184
Outside Waratek scope1
Not applicable3
Critical4
not blocked4
No public exploit4
20191
Not applicable1
Critical1
not blocked1
No public exploit1
20201
Not applicable1
Critical1
not blocked1
Exploited1
20212
Outside Waratek scope1
Not applicable1
Critical2
not blocked2
No public exploit2
202241
Outside Waratek scope16
Not applicable25
Critical41
not blocked41
Exploited4
Working exploit published7
Proof of concept only6
No public exploit24
20237
Outside Waratek scope2
Not applicable5
Critical7
not blocked7
Working exploit published1
Proof of concept only1
No public exploit5
20244
Not applicable4
Critical4
not blocked4
Proof of concept only2
No public exploit2
20255
Outside Waratek scope2
Not applicable3
Critical5
not blocked5
Proof of concept only2
No public exploit3
20182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-53975 | Critical | 2025-12-22 | Not applicable | No public exploit | Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks. |
| CVE-2025-56316 | Critical | 2025-10-17 | Outside Waratek scope | No public exploit | A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering. |
| CVE-2025-55835 | Critical | 2025-09-12 | Not applicable | Proof of concept only | File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering. |
| CVE-2025-29287 | Critical | 2025-04-21 | Outside Waratek scope | Proof of concept only | An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2025-25686 | Critical | 2025-03-27 | Not applicable | No public exploit | semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php. |
| CVE-2024-46103 | Critical | 2024-09-20 | Not applicable | No public exploit | SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php. |
| CVE-2024-30938 | Critical | 2024-04-19 | Not applicable | Proof of concept only | SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS_User.php component. |
| CVE-2024-31012 | Critical | 2024-04-03 | Not applicable | Proof of concept only | An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the upload.php file. |
| CVE-2024-25422 | Critical | 2024-02-28 | Not applicable | No public exploit | SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php component. |
| CVE-2023-50578 | Critical | 2023-12-30 | Outside Waratek scope | Working exploit published | Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do. |
| CVE-2023-50563 | Critical | 2023-12-14 | Not applicable | No public exploit | Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php. |
| CVE-2023-37647 | Critical | 2023-07-31 | Not applicable | No public exploit | SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php. |
| CVE-2020-18432 | Critical | 2023-06-30 | Not applicable | No public exploit | File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges. |
| CVE-2023-31707 | Critical | 2023-05-19 | Not applicable | No public exploit | SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php. |
| CVE-2023-30090 | Critical | 2023-05-05 | Not applicable | No public exploit | Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to execute arbitrary code via uploading a crafted PHP file. |
| CVE-2020-20913 | Critical | 2023-04-04 | Outside Waratek scope | Proof of concept only | SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter. |
| CVE-2022-4375 | Critical | 2022-12-09 | Outside Waratek scope | Working exploit published | A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196. |
| CVE-2021-38737 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php. |
| CVE-2021-38736 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php. |
| CVE-2021-38734 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php. |
| CVE-2021-38733 | Critical | 2022-10-28 | Not applicable | No public exploit | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php. |
| CVE-2021-38732 | Critical | 2022-10-28 | Not applicable | No public exploit | SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php. |
| CVE-2021-38731 | Critical | 2022-10-28 | Not applicable | No public exploit | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php. |
| CVE-2021-38730 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php. |
| CVE-2021-38729 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php. |
| CVE-2021-38217 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php. |
| CVE-2022-36599 | Critical | 2022-08-16 | Outside Waratek scope | No public exploit | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists. |
| CVE-2022-36272 | Critical | 2022-08-16 | Outside Waratek scope | No public exploit | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter. |
| CVE-2022-2726 | Critical | 2022-08-09 | Not applicable | No public exploit | A vulnerability classified as critical has been found in SEMCMS. This affects an unknown part of the file Ant_Check.php. The manipulation of the argument DID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205839. |
| CVE-2022-31943 | Critical | 2022-07-01 | Outside Waratek scope | No public exploit | MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability. |
| CVE-2022-30506 | Critical | 2022-06-02 | Outside Waratek scope | No public exploit | An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file. |
| CVE-2022-30048 | Critical | 2022-05-11 | Not applicable | No public exploit | Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter. |
| CVE-2022-30047 | Critical | 2022-05-11 | Not applicable | Exploited | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter. |
| CVE-2022-27466 | Critical | 2022-05-02 | Not applicable | No public exploit | MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do. |
| CVE-2022-28036 | Critical | 2022-04-12 | Not applicable | No public exploit | AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_navigation.php |
| CVE-2022-28035 | Critical | 2022-04-12 | Not applicable | No public exploit | Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_blur-save.php |
| CVE-2022-28034 | Critical | 2022-04-12 | Not applicable | No public exploit | AtomCMS 2.0 is vulnerabie to SQL Injection via Atom.CMS_admin_ajax_list-sort.php |
| CVE-2022-28033 | Critical | 2022-04-12 | Not applicable | Working exploit published | Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php |
| CVE-2022-28032 | Critical | 2022-04-12 | Not applicable | Working exploit published | AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php |
| CVE-2022-26585 | Critical | 2022-04-05 | Outside Waratek scope | Working exploit published | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list. |
| CVE-2022-25488 | Critical | 2022-03-15 | Not applicable | Exploited | Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php. |
| CVE-2022-25487 | Critical | 2022-03-15 | Not applicable | Exploited | Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. |
| CVE-2022-23383 | Critical | 2022-03-10 | Not applicable | No public exploit | YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non login status because real authentication is not carried out. |
| CVE-2021-46384 | Critical | 2022-03-04 | Outside Waratek scope | No public exploit | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS. |
| CVE-2022-25125 | Critical | 2022-03-03 | Not applicable | Working exploit published | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. |
| CVE-2022-23899 | Critical | 2022-03-03 | Outside Waratek scope | No public exploit | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java. |
| CVE-2022-23898 | Critical | 2022-03-03 | Outside Waratek scope | Working exploit published | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. |
| CVE-2021-46063 | Critical | 2022-02-18 | Outside Waratek scope | No public exploit | MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module. |
| CVE-2021-46036 | Critical | 2022-02-18 | Outside Waratek scope | No public exploit | An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code. |
| CVE-2021-44868 | Critical | 2022-02-17 | Outside Waratek scope | Exploited | A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do |
| CVE-2022-24223 | Critical | 2022-02-01 | Not applicable | Working exploit published | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. |
| CVE-2021-46386 | Critical | 2022-01-26 | Outside Waratek scope | No public exploit | File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload. |
| CVE-2022-23315 | Critical | 2022-01-21 | Outside Waratek scope | No public exploit | MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. |
| CVE-2022-23314 | Critical | 2022-01-21 | Not applicable | No public exploit | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. |
| CVE-2022-22930 | Critical | 2022-01-21 | Outside Waratek scope | No public exploit | A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. |
| CVE-2022-22929 | Critical | 2022-01-21 | Outside Waratek scope | No public exploit | MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file. |
| CVE-2022-22928 | Critical | 2022-01-21 | Not applicable | No public exploit | MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code. |
| CVE-2020-18078 | Critical | 2021-12-17 | Not applicable | No public exploit | A vulnerability in /include/web_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password. |
| CVE-2020-23262 | Critical | 2021-01-26 | Outside Waratek scope | No public exploit | An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do. |
| CVE-2020-29597 | Critical | 2020-12-07 | Not applicable | Exploited | IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attackers to upload files into the server. |
| CVE-2019-1010151 | Critical | 2019-07-19 | Not applicable | No public exploit | zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php. |
| CVE-2018-18830 | Critical | 2018-10-30 | Outside Waratek scope | No public exploit | An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code. |
| CVE-2018-14579 | Critical | 2018-07-24 | Not applicable | No public exploit | GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for install/install.sql. |
| CVE-2018-12630 | Critical | 2018-06-21 | Not applicable | No public exploit | NEWMARK (aka New Mark) NMCMS 2.1 allows SQL Injection via the sect_id parameter to the /catalog URI. |
| CVE-2018-11554 | Critical | 2018-06-05 | Not applicable | No public exploit | The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach. |