WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product projects✕
Overview 11 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
11matches 1in Waratek scope9.1% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC18.2% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 9.1% Outside Waratek scope 0 0.0% Not applicable 10 90.9% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 11 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 18.2% Proof of concept only 3 27.3% Forecast only 0 0.0% No public exploit 6 54.5%
split by peak 3 / year
Not applicable: 10No exploit published: 1 High: 11 not blocked: 11 No public exploit: 6Proof of concept only: 3Working exploit published: 2
20101 Not applicable1 High1 not blocked1 Working exploit published1 20110 20120 20130 20140 20151 Not applicable1 High1 not blocked1 Working exploit published1 20160 20170 20180 20193 Not applicable3 High3 not blocked3 No public exploit3 20200 20213 No exploit published1 Not applicable2 High3 not blocked3 No public exploit3 20220 20230 20240 20252 Not applicable2 High2 not blocked2 Proof of concept only2 20261 Not applicable1 High1 not blocked1 Proof of concept only1
201020122014201620182020202220242026
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-20253 High 2026-06-19 Not applicable Proof of concept only Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data.
CVE-2023-53980 High 2025-12-22 Not applicable Proof of concept only ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
CVE-2023-53930 High 2025-12-17 Not applicable Proof of concept only ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.
CVE-2021-40884 High 2021-10-11 Not applicable No public exploit Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-edit.php and id parameter in process.php function, a user with uploader role can download and edit all files of users in application.
CVE-2021-2258 High 2021-04-22 No exploit published No public exploit Vulnerability in the Oracle Projects product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Projects. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Projects accessible data as well as unauthorized access to critical data or complete access to all Oracle Projects accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2020-28874 High 2021-01-26 Not applicable No public exploit reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
CVE-2018-7201 High 2019-05-22 Not applicable No public exploit CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
CVE-2019-11492 High 2019-04-26 Not applicable No public exploit ProjectSend before r1070 writes user passwords to the server logs.
CVE-2019-11378 High 2019-04-20 Not applicable No public exploit An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2014-9567 High 2015-01-07 Not applicable Working exploit published Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.
CVE-2010-1363 High 2010-04-13 Not applicable Working exploit published SQL injection vulnerability in the JProjects (com_j-projects) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the project parameter in a projects action to index.php.