WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ninja✕
Overview 30 matches · 1 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 5 public PoC · 0 EPSS ≥ 0.5
30matches 1in Waratek scope3.3% 0protected0.0% 1exploited3.3% 0CISA KEV0.0% 5public PoC16.7% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 3.3% Outside Waratek scope 0 0.0% Not applicable 29 96.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 30 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 30 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 3.3% Working exploit published 4 13.3% Proof of concept only 4 13.3% Forecast only 0 0.0% No public exploit 21 70.0%
split by peak 8 / year
Not applicable: 29No exploit published: 1 High: 30 not blocked: 30 No public exploit: 21Proof of concept only: 4Working exploit published: 4Exploited: 1
20091 Not applicable1 High1 not blocked1 Working exploit published1 20100 20111 Not applicable1 High1 not blocked1 Working exploit published1 20120 20131 Not applicable1 High1 not blocked1 No public exploit1 20140 20151 Not applicable1 High1 not blocked1 No public exploit1 20160 20170 20181 Not applicable1 High1 not blocked1 No public exploit1 20192 Not applicable2 High2 not blocked2 Proof of concept only1 No public exploit1 20200 20217 Not applicable7 High7 not blocked7 No public exploit7 20223 Not applicable3 High3 not blocked3 Working exploit published1 Proof of concept only1 No public exploit1 20232 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 20248 No exploit published1 Not applicable7 High8 not blocked8 Proof of concept only1 No public exploit7 20252 Not applicable2 High2 not blocked2 Exploited1 No public exploit1 20261 Not applicable1 High1 not blocked1 Proof of concept only1
201020122014201620182020202220242026
30 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-29925 High 2026-03-30 Not applicable Proof of concept only Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.
CVE-2025-11924 High 2025-12-17 Not applicable Exploited The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.
CVE-2025-2940 High 2025-06-27 Not applicable No public exploit The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE-2024-11052 High 2024-12-12 Not applicable No public exploit The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2021-4451 High 2024-10-16 Not applicable No public exploit The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall).
CVE-2024-1596 High 2024-09-07 Not applicable No public exploit The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-39628 High 2024-08-26 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.
CVE-2023-38393 High 2024-06-19 Not applicable Proof of concept only Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
CVE-2024-36823 High 2024-06-06 No exploit published No public exploit The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.
CVE-2023-36505 High 2024-04-17 Not applicable No public exploit Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.
CVE-2024-25572 High 2024-04-11 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.
CVE-2023-37979 High 2023-07-27 Not applicable Working exploit published Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.
CVE-2022-47136 High 2023-05-25 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.
CVE-2022-2903 High 2022-09-26 Not applicable Proof of concept only The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
CVE-2022-2544 High 2022-08-22 Not applicable Working exploit published The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
CVE-2022-0889 High 2022-03-23 Not applicable No public exploit The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
CVE-2021-24889 High 2021-11-29 Not applicable No public exploit The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
CVE-2021-26274 High 2021-07-07 Not applicable No public exploit The Agent in NinjaRMM 5.0.909 has Insecure Permissions.
CVE-2021-26273 High 2021-07-07 Not applicable No public exploit The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.
CVE-2021-31516 High 2021-06-29 Not applicable No public exploit This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13670.
CVE-2021-31515 High 2021-06-29 Not applicable No public exploit This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13668.
CVE-2021-33898 High 2021-06-06 Not applicable No public exploit In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it.
CVE-2021-24163 High 2021-04-05 Not applicable No public exploit The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
CVE-2018-20980 High 2019-08-22 Not applicable No public exploit The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
CVE-2019-10869 High 2019-05-07 Not applicable Proof of concept only Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
CVE-2018-16308 High 2018-09-01 Not applicable No public exploit The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
CVE-2014-9688 High 2015-03-05 Not applicable No public exploit Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
CVE-2012-6503 High 2013-01-24 Not applicable No public exploit Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors.
CVE-2010-4991 High 2011-11-01 Not applicable Working exploit published SQL injection vulnerability in the NinjaMonials (com_ninjamonials) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a display action to index.php.
CVE-2009-3964 High 2009-11-18 Not applicable Working exploit published SQL injection vulnerability in the NinjaMonials (com_ninjacentral) component 1.1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php.