Overview 70 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
70matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
4public PoC5.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
4
5.7%
Not applicable
66
94.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
70
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
3
4.3%
Proof of concept only
19
27.1%
Forecast only
0
0.0%
No public exploit
48
68.6%
split by
peak 21 / year
201821
Not applicable21
Medium21
not blocked21
Working exploit published1
Proof of concept only1
No public exploit19
20196
Not applicable6
Medium6
not blocked6
No public exploit6
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20218
Not applicable8
Medium8
not blocked8
No public exploit8
20226
Outside Waratek scope2
Not applicable4
Medium6
not blocked6
Working exploit published1
Proof of concept only2
No public exploit3
20233
Outside Waratek scope1
Not applicable2
Medium3
not blocked3
Working exploit published1
No public exploit2
20248
Not applicable8
Medium8
not blocked8
Proof of concept only4
No public exploit4
202516
Outside Waratek scope1
Not applicable15
Medium16
not blocked16
Proof of concept only11
No public exploit5
20261
Not applicable1
Medium1
not blocked1
Proof of concept only1
201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-29933 | Medium | 2026-03-26 | Not applicable | Proof of concept only | A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer value in the request header. |
| CVE-2025-60837 | Medium | 2025-10-23 | Outside Waratek scope | No public exploit | A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. |
| CVE-2025-60838 | Medium | 2025-10-10 | Not applicable | No public exploit | An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2025-55797 | Medium | 2025-09-30 | Not applicable | No public exploit | An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed. |
| CVE-2025-56304 | Medium | 2025-09-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page. |
| CVE-2025-56236 | Medium | 2025-08-28 | Not applicable | No public exploit | FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context. |
| CVE-2025-51660 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php. |
| CVE-2025-51659 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php. |
| CVE-2025-51658 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php. |
| CVE-2025-51657 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php. |
| CVE-2025-51656 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php. |
| CVE-2025-51655 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php. |
| CVE-2025-51654 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php. |
| CVE-2025-51653 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php. |
| CVE-2025-51652 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php. |
| CVE-2025-3397 | Medium | 2025-04-08 | Not applicable | Proof of concept only | A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-13193 | Medium | 2025-01-08 | Not applicable | Proof of concept only | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Images.php of the component Image Library Management Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-52725 | Medium | 2024-11-20 | Not applicable | No public exploit | SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_SeoAndTag.php component. |
| CVE-2024-39174 | Medium | 2024-07-05 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article. |
| CVE-2024-36801 | Medium | 2024-06-04 | Not applicable | No public exploit | A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.php. |
| CVE-2024-35110 | Medium | 2024-05-17 | Not applicable | Proof of concept only | A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker. |
| CVE-2024-4595 | Medium | 2024-05-07 | Not applicable | Proof of concept only | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263317 was assigned to this vulnerability. |
| CVE-2024-31009 | Medium | 2024-04-03 | Not applicable | Proof of concept only | SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php. |
| CVE-2024-24291 | Medium | 2024-02-06 | Not applicable | No public exploit | An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL. |
| CVE-2023-52274 | Medium | 2024-01-11 | Not applicable | No public exploit | member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header. |
| CVE-2023-3990 | Medium | 2023-07-28 | Outside Waratek scope | Working exploit published | A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611. |
| CVE-2020-20502 | Medium | 2023-06-20 | Not applicable | No public exploit | Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function. |
| CVE-2021-36712 | Medium | 2023-02-03 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function. |
| CVE-2022-4640 | Medium | 2022-12-21 | Outside Waratek scope | Proof of concept only | A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216499. |
| CVE-2022-4350 | Medium | 2022-12-08 | Outside Waratek scope | Proof of concept only | A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation of the argument content_title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215112. |
| CVE-2021-38728 | Medium | 2022-10-28 | Not applicable | No public exploit | SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php. |
| CVE-2022-25489 | Medium | 2022-03-15 | Not applicable | Working exploit published | Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php. |
| CVE-2022-23889 | Medium | 2022-01-28 | Not applicable | No public exploit | The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments. |
| CVE-2022-23887 | Medium | 2022-01-28 | Not applicable | No public exploit | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete. |
| CVE-2020-19950 | Medium | 2021-09-23 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML. |
| CVE-2020-19949 | Medium | 2021-09-23 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML. |
| CVE-2020-19118 | Medium | 2021-07-30 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html. |
| CVE-2020-35972 | Medium | 2021-06-03 | Not applicable | No public exploit | An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html. |
| CVE-2020-35971 | Medium | 2021-06-03 | Not applicable | No public exploit | A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html page. |
| CVE-2020-23370 | Medium | 2021-05-10 | Not applicable | No public exploit | In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML. |
| CVE-2020-23369 | Medium | 2021-05-10 | Not applicable | No public exploit | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. |
| CVE-2020-18084 | Medium | 2021-04-30 | Not applicable | No public exploit | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in. |
| CVE-2020-22394 | Medium | 2020-11-19 | Not applicable | No public exploit | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. |
| CVE-2019-16532 | Medium | 2019-09-26 | Not applicable | No public exploit | An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections. |
| CVE-2019-16678 | Medium | 2019-09-21 | Not applicable | No public exploit | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. |
| CVE-2018-16247 | Medium | 2019-06-20 | Not applicable | No public exploit | YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. |
| CVE-2019-9661 | Medium | 2019-03-11 | Not applicable | No public exploit | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, |
| CVE-2019-9660 | Medium | 2019-03-11 | Not applicable | No public exploit | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. |
| CVE-2019-9570 | Medium | 2019-03-05 | Not applicable | No public exploit | An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. |
| CVE-2018-20017 | Medium | 2018-12-10 | Not applicable | No public exploit | SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI. |
| CVE-2018-19849 | Medium | 2018-12-04 | Not applicable | No public exploit | An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter. |
| CVE-2018-19092 | Medium | 2018-11-07 | Not applicable | No public exploit | An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie. |
| CVE-2018-18841 | Medium | 2018-10-30 | Not applicable | No public exploit | XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter. |
| CVE-2018-18840 | Medium | 2018-10-30 | Not applicable | No public exploit | XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexmetatit parameter. |
| CVE-2018-18783 | Medium | 2018-10-29 | Not applicable | No public exploit | XSS was discovered in SEMCMS V3.4 via the semcms_remail.php?type=ok umail parameter. |
| CVE-2018-18745 | Medium | 2018-10-29 | Not applicable | No public exploit | An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing. |
| CVE-2018-18744 | Medium | 2018-10-29 | Not applicable | No public exploit | An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS_Main.php URI. |
| CVE-2018-18743 | Medium | 2018-10-29 | Not applicable | No public exploit | An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI. |
| CVE-2018-18741 | Medium | 2018-10-29 | Not applicable | No public exploit | An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Download.php?lgid=1 during editing. |
| CVE-2018-18740 | Medium | 2018-10-29 | Not applicable | No public exploit | An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI. |
| CVE-2018-18739 | Medium | 2018-10-29 | Not applicable | No public exploit | An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field. |
| CVE-2018-18738 | Medium | 2018-10-29 | Not applicable | No public exploit | An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Categories.php?pid=1&lgid=1 category_key parameter. |
| CVE-2018-17044 | Medium | 2018-09-14 | Not applicable | No public exploit | In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. |
| CVE-2018-16346 | Medium | 2018-09-02 | Not applicable | No public exploit | ChemCMS 1.0.6 has XSS via the "setting -> website information" field. |
| CVE-2018-10224 | Medium | 2018-04-19 | Not applicable | No public exploit | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. |
| CVE-2018-10223 | Medium | 2018-04-19 | Not applicable | No public exploit | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.html. |
| CVE-2018-10026 | Medium | 2018-04-11 | Not applicable | No public exploit | The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php. |
| CVE-2018-8078 | Medium | 2018-03-13 | Not applicable | Proof of concept only | YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html. |
| CVE-2018-7653 | Medium | 2018-03-04 | Not applicable | Working exploit published | In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter. |
| CVE-2018-7479 | Medium | 2018-02-26 | Not applicable | No public exploit | YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php. |