Overview 15 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
15matches
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
15
100.0%
Outside Waratek scope
0
0.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
15
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
7
46.7%
Forecast only
0
0.0%
No public exploit
8
53.3%
split by
peak 8 / quarter
Q4 238
No exploit published8
High4
Medium4
not blocked8
Proof of concept only2
No public exploit6
Q1 240
Q2 242
No exploit published2
Critical1
Medium1
not blocked2
Proof of concept only1
No public exploit1
Q3 242
No exploit published2
Critical1
Medium1
not blocked2
Proof of concept only1
No public exploit1
Q4 240
Q1 251
No exploit published1
Medium1
not blocked1
Proof of concept only1
Q2 250
Q3 251
No exploit published1
Medium1
not blocked1
Proof of concept only1
Q4 250
Q1 260
Q2 261
No exploit published1
Medium1
not blocked1
Proof of concept only1
Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25Q1 26Q2 26
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-30139 | Medium | 2026-04-22 | No exploit published | Proof of concept only | A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attackers to execute arbitrary JavaScript in the context of a user's browser via crafted input. |
| CVE-2025-46047 | Medium | 2025-09-02 | No exploit published | Proof of concept only | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter. |
| CVE-2024-56923 | Medium | 2025-01-22 | No exploit published | Proof of concept only | Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription. |
| CVE-2024-42850 | Critical | 2024-08-16 | No exploit published | No public exploit | An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. |
| CVE-2024-39031 | Medium | 2024-07-09 | No exploit published | Proof of concept only | In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event. |
| CVE-2024-36042 | Critical | 2024-06-03 | No exploit published | Proof of concept only | Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticated user with superadmin access. |
| CVE-2024-29392 | Medium | 2024-05-22 | No exploit published | No public exploit | Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController. |
| CVE-2023-47327 | Medium | 2023-12-13 | No exploit published | No public exploit | The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL. |
| CVE-2023-47326 | High | 2023-12-13 | No exploit published | No public exploit | Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. |
| CVE-2023-47325 | Medium | 2023-12-13 | No exploit published | Proof of concept only | Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces. |
| CVE-2023-47324 | Medium | 2023-12-13 | No exploit published | No public exploit | Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. |
| CVE-2023-47323 | High | 2023-12-13 | No exploit published | No public exploit | The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators. |
| CVE-2023-47322 | High | 2023-12-13 | No exploit published | No public exploit | The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application. |
| CVE-2023-47321 | Medium | 2023-12-13 | No exploit published | No public exploit | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. |
| CVE-2023-47320 | High | 2023-12-13 | No exploit published | Proof of concept only | Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below. |