WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product tiles✕
Overview 15 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
15matches 0in Waratek scope0.0% 0protected0.0% 2exploited13.3% 0CISA KEV0.0% 3public PoC20.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 15 100.0% Withdrawn CVE 0 0.0%
Critical 3 20.0% High 3 20.0% Medium 9 60.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 15 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 13.3% Working exploit published 1 6.7% Proof of concept only 4 26.7% Forecast only 0 0.0% No public exploit 8 53.3%
split by peak 4 / year
Not applicable: 15 Medium: 9High: 3Critical: 3 not blocked: 15 No public exploit: 8Proof of concept only: 4Working exploit published: 1Exploited: 2
20141 Not applicable1 Medium1 not blocked1 No public exploit1 20150 20160 20170 20181 Not applicable1 Critical1 not blocked1 No public exploit1 20190 20202 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20210 20221 Not applicable1 Medium1 not blocked1 No public exploit1 20234 Not applicable4 High2 Medium2 not blocked4 Proof of concept only2 No public exploit2 20242 Not applicable2 Medium2 not blocked2 Proof of concept only1 No public exploit1 20254 Not applicable4 Critical2 High1 Medium1 not blocked4 Exploited2 Proof of concept only1 No public exploit1
201420152016201720182019202020212022202320242025
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-54865 Critical 2025-08-05 Not applicable Proof of concept only Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the Tilesheets extension allows users to insert and potentially execute malicious SQL code. This issue has not been fixed.
CVE-2025-44137 High 2025-07-29 Not applicable Exploited MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format"
CVE-2025-44136 Critical 2025-07-29 Not applicable Exploited MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
CVE-2024-6261 Medium 2025-02-27 Not applicable No public exploit The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-10503 Medium 2024-10-30 Not applicable No public exploit A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-3710 Medium 2024-07-13 Not applicable Proof of concept only The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
CVE-2023-30969 High 2023-10-26 Not applicable No public exploit The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.
CVE-2023-25482 High 2023-07-18 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <= 1.1.2 versions.
CVE-2023-1426 Medium 2023-04-10 Not applicable Proof of concept only The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post.
CVE-2022-4827 Medium 2023-04-10 Not applicable Proof of concept only The WP Tiles WordPress plugin through 1.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-0186 Medium 2022-02-21 Not applicable No public exploit The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
CVE-2020-15500 Medium 2020-07-01 Not applicable Working exploit published An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.
CVE-2020-14962 Medium 2020-06-22 Not applicable No public exploit Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.
CVE-2018-1000620 Critical 2018-07-09 Not applicable No public exploit Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
CVE-2014-7597 Medium 2014-10-20 Not applicable No public exploit The Fabulas Infantiles (aka com.mobincube.android.sc_9I1A3) application 3.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.