Overview 39 matches · 31 in Waratek scope · 1 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
39matches
31in Waratek scope79.5%
1protected2.6%
1exploited2.6%
0CISA KEV0.0%
1public PoC2.6%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
2.6%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
30
76.9%
Outside Waratek scope
0
0.0%
Not applicable
8
20.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
2.6%
partly blocked
0
0.0%
not blocked
38
97.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
2.6%
Working exploit published
0
0.0%
Proof of concept only
10
25.6%
Forecast only
0
0.0%
No public exploit
28
71.8%
split by
peak 27 / quarter
Q2 221
Not applicable1
Critical1
not blocked1
No public exploit1
Q3 220
Q4 220
Q1 230
Q2 230
Q3 231
Not applicable1
Medium1
not blocked1
Exploited1
Q4 2327
Protected by Waratek1
No exploit published26
High20
Medium7
blocked by ARMR today1
not blocked26
No public exploit27
Q1 248
No exploit published4
Not applicable4
Critical1
High1
Medium6
not blocked8
Proof of concept only8
Q2 241
Not applicable1
Medium1
not blocked1
Proof of concept only1
Q3 241
Not applicable1
High1
not blocked1
Proof of concept only1
Q2 22Q3 22Q4 22Q1 23Q2 23Q3 23Q4 23Q1 24Q2 24Q3 24
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-40322 | High | 2024-07-16 | Not applicable | Proof of concept only | An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data |
| CVE-2023-51254 | Medium | 2024-04-29 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the friendship link component. |
| CVE-2024-24375 | High | 2024-03-07 | Not applicable | Proof of concept only | SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter. |
| CVE-2024-24029 | Critical | 2024-02-02 | Not applicable | Proof of concept only | JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data. |
| CVE-2024-22497 | Medium | 2024-01-23 | No exploit published | Proof of concept only | Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. |
| CVE-2024-22496 | Medium | 2024-01-23 | No exploit published | Proof of concept only | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. |
| CVE-2024-22494 | Medium | 2024-01-12 | Not applicable | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2024-22493 | Medium | 2024-01-12 | No exploit published | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2024-22492 | Medium | 2024-01-12 | No exploit published | Proof of concept only | A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2023-50136 | Medium | 2024-01-09 | Not applicable | Proof of concept only | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. |
| CVE-2023-50137 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. |
| CVE-2023-50102 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). |
| CVE-2023-50101 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. |
| CVE-2023-50100 | Medium | 2023-12-14 | No exploit published | No public exploit | JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. |
| CVE-2023-50449 | High | 2023-12-10 | Protected by Waratek | No public exploit | JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey parameter. |
| CVE-2023-49487 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department. |
| CVE-2023-49486 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department. |
| CVE-2023-49485 | Medium | 2023-12-08 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. |
| CVE-2023-49448 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete. |
| CVE-2023-49447 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update. |
| CVE-2023-49446 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save. |
| CVE-2023-49398 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete. |
| CVE-2023-49397 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus. |
| CVE-2023-49396 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save. |
| CVE-2023-49395 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update. |
| CVE-2023-49383 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. |
| CVE-2023-49382 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete. |
| CVE-2023-49381 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update. |
| CVE-2023-49380 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete. |
| CVE-2023-49379 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save. |
| CVE-2023-49378 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save. |
| CVE-2023-49377 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update. |
| CVE-2023-49376 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete. |
| CVE-2023-49375 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update. |
| CVE-2023-49374 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update. |
| CVE-2023-49373 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete. |
| CVE-2023-49372 | High | 2023-12-05 | No exploit published | No public exploit | JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save. |
| CVE-2023-41599 | Medium | 2023-09-19 | Not applicable | Exploited | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. |
| CVE-2022-27341 | Critical | 2022-04-22 | Not applicable | No public exploit | JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. |