WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor net.mingsoft✕
Overview 12 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
12matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 12 100.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 12 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 12 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 4 33.3% Forecast only 0 0.0% No public exploit 8 66.7%
split by peak 4 / quarter
Outside Waratek scope: 12 High: 12 not blocked: 12 No public exploit: 8Proof of concept only: 4
Q3 181 Outside Waratek scope1 High1 not blocked1 No public exploit1 Q4 181 Outside Waratek scope1 High1 not blocked1 No public exploit1 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 224 Outside Waratek scope4 High4 not blocked4 No public exploit4 Q2 222 Outside Waratek scope2 High2 not blocked2 No public exploit2 Q3 220 Q4 220 Q1 231 Outside Waratek scope1 High1 not blocked1 Proof of concept only1 Q2 231 Outside Waratek scope1 High1 not blocked1 Proof of concept only1 Q3 230 Q4 230 Q1 242 Outside Waratek scope2 High2 not blocked2 Proof of concept only2
Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-22567 High 2024-02-05 Outside Waratek scope Proof of concept only File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.
CVE-2023-51282 High 2024-01-16 Outside Waratek scope Proof of concept only An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.
CVE-2020-22755 High 2023-05-08 Outside Waratek scope Proof of concept only File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.
CVE-2022-47042 High 2023-01-26 Outside Waratek scope Proof of concept only MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
CVE-2022-29647 High 2022-06-02 Outside Waratek scope No public exploit An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
CVE-2022-27340 High 2022-04-22 Outside Waratek scope No public exploit MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
CVE-2021-46062 High 2022-02-18 Outside Waratek scope No public exploit MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
CVE-2021-46037 High 2022-02-18 Outside Waratek scope No public exploit MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
CVE-2021-46385 High 2022-01-26 Outside Waratek scope No public exploit https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.
CVE-2021-46383 High 2022-01-26 Outside Waratek scope No public exploit https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.
CVE-2018-18831 High 2018-10-30 Outside Waratek scope No public exploit An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter.
CVE-2018-17366 High 2018-09-23 Outside Waratek scope No public exploit An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.