WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product projects✕
Overview 22 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
22matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 3public PoC13.6% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 22 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 22 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 22 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 13.6% Proof of concept only 4 18.2% Forecast only 0 0.0% No public exploit 15 68.2%
split by peak 4 / year
Not applicable: 22 Medium: 22 not blocked: 22 No public exploit: 15Proof of concept only: 4Working exploit published: 3
20011 Not applicable1 Medium1 not blocked1 No public exploit1 20020 20030 20040 20050 20060 20070 20080 20090 20100 20110 20120 20131 Not applicable1 Medium1 not blocked1 No public exploit1 20142 Not applicable2 Medium2 not blocked2 No public exploit2 20152 Not applicable2 Medium2 not blocked2 Working exploit published2 20161 Not applicable1 Medium1 not blocked1 No public exploit1 20171 Not applicable1 Medium1 not blocked1 No public exploit1 20182 Not applicable2 Medium2 not blocked2 No public exploit2 20192 Not applicable2 Medium2 not blocked2 No public exploit2 20200 20212 Not applicable2 Medium2 not blocked2 No public exploit2 20221 Not applicable1 Medium1 not blocked1 Proof of concept only1 20231 Not applicable1 Medium1 not blocked1 Proof of concept only1 20242 Not applicable2 Medium2 not blocked2 No public exploit2 20254 Not applicable4 Medium4 not blocked4 Working exploit published1 Proof of concept only2 No public exploit1
2001200320052007200920112013201520172019202120232025
22 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-53906 Medium 2025-12-17 Not applicable Proof of concept only projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript through the custom assets configuration page. Attackers can craft a JavaScript payload in the custom assets section that will execute when other users load the affected page, enabling persistent script injection.
CVE-2023-53905 Medium 2025-12-17 Not applicable Proof of concept only ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.
CVE-2024-13115 Medium 2025-02-04 Not applicable No public exploit The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVE-2024-13114 Medium 2025-02-04 Not applicable Working exploit published The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2024-7659 Medium 2024-08-12 Not applicable No public exploit A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component.
CVE-2024-7658 Medium 2024-08-12 Not applicable No public exploit A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function get_preview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720 is able to address this issue. The patch is named eb5a04774927e5855b9d0e5870a2aae5a3dc5a08. It is recommended to upgrade the affected component.
CVE-2023-0607 Medium 2023-02-01 Not applicable Proof of concept only Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.
CVE-2017-20101 Medium 2022-06-27 Not applicable Proof of concept only A vulnerability, which was classified as problematic, was found in ProjectSend r754. This affects an unknown part of the file process.php?do=zip_download. The manipulation of the argument client/file leads to information disclosure. It is possible to initiate the attack remotely.
CVE-2021-40888 Medium 2021-10-11 Not applicable No public exploit Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code.
CVE-2021-40886 Medium 2021-10-11 Not applicable No public exploit Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` parameter to bypass `fileName` sanitization.
CVE-2018-7202 Medium 2019-05-22 Not applicable No public exploit An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page.
CVE-2019-11533 Medium 2019-04-26 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.
CVE-2017-9786 Medium 2018-03-06 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php.
CVE-2017-9783 Medium 2018-03-06 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in a Site name updated.
CVE-2016-8213 Medium 2017-01-23 Not applicable No public exploit EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; and EMC Documentum Capital Projects Version 1.9, prior to P30 and Version 1.10, prior to P17; and EMC Documentum Administrator Version 7.0, Version 7.1, and Version 7.2 prior to P18 contain a Stored Cross-Site Scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVE-2016-0914 Medium 2016-06-23 Not applicable No public exploit EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before Patch 23 and 1.10 before Patch 10, and Documentum TaskSpace 6.7 SP3 allow remote authenticated users to bypass intended access restrictions and execute arbitrary IAPI/IDQL commands via the IAPI/IDQL interface.
CVE-2015-2564 Medium 2015-03-20 Not applicable Working exploit published SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.
CVE-2014-9580 Medium 2015-01-08 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information.
CVE-2014-2518 Medium 2014-08-20 Not applicable No public exploit Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Documentum WDK before 6.7SP1 P28 and 6.7SP2 before P15 allow remote attackers to hijack the authentication of arbitrary users.
CVE-2014-2511 Medium 2014-08-20 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.
CVE-2013-3281 Medium 2013-11-06 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2 P07, Documentum WDK before 6.7 SP2 P07, Documentum Taskspace before 6.7 SP2 P07, Documentum Records Manager before 6.7 SP2 P07, Documentum Web Publisher before 6.5 SP7, Documentum Digital Asset Manager before 6.5 SP6, Documentum Administrator before 6.7 SP2 P07, and Documentum Capital Projects before 1.8 P01 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter in a URL.
CVE-2001-1488 Medium 2001-12-31 Not applicable No public exploit Open Projects Network Internet Relay Chat (IRC) daemon u2.10.05.18 does not perform a double-reverse DNS lookup, which allows remote attackers to spoof any valid hostname on the Internet. NOTE: a followup post suggests that this is not an issue in the daemon.