WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product mcms✕
Overview 41 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 6 public PoC · 0 EPSS ≥ 0.5
41matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 6public PoC14.6% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 12 29.3% Not applicable 29 70.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 41 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 41 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 6 14.6% Proof of concept only 12 29.3% Forecast only 0 0.0% No public exploit 23 56.1%
split by peak 9 / year
Not applicable: 29Outside Waratek scope: 12 High: 41 not blocked: 41 No public exploit: 23Proof of concept only: 12Working exploit published: 6
20072 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 20084 Not applicable4 High4 not blocked4 Working exploit published4 20090 20100 20110 20120 20130 20141 Not applicable1 High1 not blocked1 Working exploit published1 20150 20160 20170 20187 Outside Waratek scope2 Not applicable5 High7 not blocked7 No public exploit7 20191 Not applicable1 High1 not blocked1 No public exploit1 20200 20214 Not applicable4 High4 not blocked4 No public exploit4 20228 Outside Waratek scope6 Not applicable2 High8 not blocked8 No public exploit8 20235 Outside Waratek scope2 Not applicable3 High5 not blocked5 Proof of concept only4 No public exploit1 20249 Outside Waratek scope2 Not applicable7 High9 not blocked9 Proof of concept only8 No public exploit1
200820102012201420162018202020222024
41 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-42991 High 2024-09-03 Not applicable Proof of concept only MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.
CVE-2024-36800 High 2024-06-04 Not applicable Proof of concept only A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php.
CVE-2024-28725 High 2024-05-06 Not applicable Proof of concept only Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings.
CVE-2024-32409 High 2024-04-19 Not applicable No public exploit An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.
CVE-2024-31010 High 2024-04-03 Not applicable Proof of concept only SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.
CVE-2024-28405 High 2024-03-29 Not applicable Proof of concept only SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page because authentication function is called from there, users gain admin privileges.
CVE-2024-22567 High 2024-02-05 Outside Waratek scope Proof of concept only File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.
CVE-2023-51282 High 2024-01-16 Outside Waratek scope Proof of concept only An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.
CVE-2023-48864 High 2024-01-10 Not applicable Proof of concept only SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php.
CVE-2023-48863 High 2023-12-04 Not applicable No public exploit SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements to the interpreter. These malicious data can deceive the interpreter, so as to execute unplanned commands or unauthorized access to data.
CVE-2020-23595 High 2023-08-11 Not applicable Proof of concept only Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint.
CVE-2020-23564 High 2023-08-05 Not applicable Proof of concept only File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php.
CVE-2020-22755 High 2023-05-08 Outside Waratek scope Proof of concept only File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.
CVE-2022-47042 High 2023-01-26 Outside Waratek scope Proof of concept only MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
CVE-2022-29647 High 2022-06-02 Outside Waratek scope No public exploit An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
CVE-2022-27340 High 2022-04-22 Outside Waratek scope No public exploit MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
CVE-2021-46062 High 2022-02-18 Outside Waratek scope No public exploit MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
CVE-2021-46037 High 2022-02-18 Outside Waratek scope No public exploit MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
CVE-2022-23384 High 2022-02-15 Not applicable No public exploit YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
CVE-2022-23888 High 2022-01-28 Not applicable No public exploit YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
CVE-2021-46385 High 2022-01-26 Outside Waratek scope No public exploit https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.
CVE-2021-46383 High 2022-01-26 Outside Waratek scope No public exploit https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.
CVE-2020-18081 High 2021-12-17 Not applicable No public exploit The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query.
CVE-2020-19951 High 2021-09-23 Not applicable No public exploit A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application.
CVE-2020-20341 High 2021-09-01 Not applicable No public exploit YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.
CVE-2020-35970 High 2021-06-03 Not applicable No public exploit An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read.
CVE-2019-11518 High 2019-04-25 Not applicable No public exploit An issue was discovered in SEMCMS 3.8. SEMCMS_Inquiry.php allows AID[] SQL Injection because the class.phpmailer.php inject_check_sql protection mechanism is incomplete.
CVE-2018-20015 High 2018-12-10 Not applicable No public exploit YzmCMS v5.2 has admin/role/add.html CSRF.
CVE-2018-18831 High 2018-10-30 Outside Waratek scope No public exploit An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter.
CVE-2018-18742 High 2018-10-29 Not applicable No public exploit A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI.
CVE-2018-17366 High 2018-09-23 Outside Waratek scope No public exploit An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
CVE-2018-10295 High 2018-04-22 Not applicable No public exploit ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account.
CVE-2018-8756 High 2018-03-18 Not applicable No public exploit Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=member_content&a=init request.
CVE-2018-7579 High 2018-03-01 Not applicable No public exploit \application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/update_category_url.html.
CVE-2014-4852 High 2014-07-10 Not applicable Working exploit published SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-5708 High 2008-12-24 Not applicable Working exploit published redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative users by using the newusername and newpassword parameters and setting the newisadmin parameter to 1.
CVE-2008-5491 High 2008-12-12 Not applicable Working exploit published SQL injection vulnerability in edit.php in SlimCMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the pageID parameter.
CVE-2008-3721 High 2008-08-20 Not applicable Working exploit published PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.
CVE-2008-3720 High 2008-08-20 Not applicable Working exploit published SQL injection vulnerability in index.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the id vector is already covered by CVE-2007-5679.
CVE-2007-5679 High 2007-10-25 Not applicable Working exploit published SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in the media page (build_media_content.php). NOTE: it was later reported that 0.7.4 is also affected.
CVE-2007-2214 High 2007-04-24 Not applicable No public exploit Unrestricted file upload vulnerability in includes/upload_file.php in DmCMS allows remote attackers to upload arbitrary PHP scripts by placing a script's contents in both the File2 and File3 parameters, and sending a ok.php?do=act Referer.