Overview 9 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
9matches
0in Waratek scope0.0%
0protected0.0%
1exploited11.1%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
9
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
9
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
11.1%
Working exploit published
0
0.0%
Proof of concept only
1
11.1%
Forecast only
0
0.0%
No public exploit
7
77.8%
split by
peak 6 / quarter
Q4 216
Not applicable6
High4
Medium2
not blocked6
Exploited1
No public exploit5
Q1 220
Q2 220
Q3 220
Q4 220
Q1 231
Not applicable1
High1
not blocked1
No public exploit1
Q2 231
Not applicable1
Medium1
not blocked1
Proof of concept only1
Q3 230
Q4 230
Q1 240
Q2 240
Q3 240
Q4 240
Q1 251
Not applicable1
Medium1
not blocked1
No public exploit1
Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-0502 | Medium | 2025-01-15 | Not applicable | No public exploit | Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0.8, from 4.1.0 before 4.1.6. |
| CVE-2023-33194 | Medium | 2023-05-26 | Not applicable | Proof of concept only | Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6. |
| CVE-2023-26020 | High | 2023-02-17 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26. |
| CVE-2021-23263 | High | 2021-12-02 | Not applicable | Exploited | Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary). |
| CVE-2021-23262 | High | 2021-12-02 | Not applicable | No public exploit | Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. |
| CVE-2021-23261 | Medium | 2021-12-02 | Not applicable | No public exploit | Authenticated administrators may override the system configuration file and cause a denial of service. |
| CVE-2021-23260 | Medium | 2021-12-02 | Not applicable | No public exploit | Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site. |
| CVE-2021-23259 | High | 2021-12-02 | Not applicable | No public exploit | Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE). |
| CVE-2021-23258 | High | 2021-12-02 | Not applicable | No public exploit | Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE). |