Overview 13 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
13matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
12
92.3%
Not applicable
1
7.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
13
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
5
38.5%
Forecast only
0
0.0%
No public exploit
8
61.5%
split by
peak 6 / year
20182
Outside Waratek scope2
High2
not blocked2
No public exploit2
20190
20200
20210
20226
Outside Waratek scope6
High6
not blocked6
No public exploit6
20232
Outside Waratek scope2
High2
not blocked2
Proof of concept only2
20243
Outside Waratek scope2
Not applicable1
High3
not blocked3
Proof of concept only3
2018201920202021202220232024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-42991 | High | 2024-09-03 | Not applicable | Proof of concept only | MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution. |
| CVE-2024-22567 | High | 2024-02-05 | Outside Waratek scope | Proof of concept only | File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do. |
| CVE-2023-51282 | High | 2024-01-16 | Outside Waratek scope | Proof of concept only | An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter. |
| CVE-2020-22755 | High | 2023-05-08 | Outside Waratek scope | Proof of concept only | File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943. |
| CVE-2022-47042 | High | 2023-01-26 | Outside Waratek scope | Proof of concept only | MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do. |
| CVE-2022-29647 | High | 2022-06-02 | Outside Waratek scope | No public exploit | An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. |
| CVE-2022-27340 | High | 2022-04-22 | Outside Waratek scope | No public exploit | MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data. |
| CVE-2021-46062 | High | 2022-02-18 | Outside Waratek scope | No public exploit | MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName. |
| CVE-2021-46037 | High | 2022-02-18 | Outside Waratek scope | No public exploit | MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do. |
| CVE-2021-46385 | High | 2022-01-26 | Outside Waratek scope | No public exploit | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. |
| CVE-2021-46383 | High | 2022-01-26 | Outside Waratek scope | No public exploit | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. |
| CVE-2018-18831 | High | 2018-10-30 | Outside Waratek scope | No public exploit | An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter. |
| CVE-2018-17366 | High | 2018-09-23 | Outside Waratek scope | No public exploit | An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. |