WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product projects✕
Overview 7 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
7matches 0in Waratek scope0.0% 0protected0.0% 1exploited14.3% 1CISA KEV14.3% 1public PoC14.3% 1EPSS ≥ 0.514.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 7 100.0% Withdrawn CVE 0 0.0%
Critical 7 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 85.7%
split by peak 4 / year
Not applicable: 7 Critical: 7 not blocked: 7 No public exploit: 6Exploited: 1
20171 Not applicable1 Critical1 not blocked1 No public exploit1 20184 Not applicable4 Critical4 not blocked4 No public exploit4 20190 20200 20211 Not applicable1 Critical1 not blocked1 No public exploit1 20220 20230 20241 Not applicable1 Critical1 not blocked1 Exploited1
20172018201920202021202220232024
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-11680 Critical 2024-11-26 Not applicable Exploited ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
CVE-2021-40887 Critical 2021-10-11 Not applicable No public exploit Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder.
CVE-2016-10734 Critical 2018-10-29 Not applicable No public exploit ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
CVE-2016-10733 Critical 2018-10-29 Not applicable No public exploit ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
CVE-2016-10732 Critical 2018-10-29 Not applicable No public exploit ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
CVE-2016-10731 Critical 2018-10-29 Not applicable No public exploit ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.
CVE-2017-9741 Critical 2017-06-18 Not applicable No public exploit install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.