CVE & Exploit Intelligence Database

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

337,847 CVEs tracked 53,242 with exploits 4,725 exploited in wild 1,540 CISA KEV 3,918 Nuclei templates 37,802 vendors 42,493 researchers

8,791 results Clear all

CVE-2008-0198 EPSS 0.00

Wp-contactform - CSRF

Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.

CWE-352 Jan 10, 2008

CVE-2007-6642 EPSS 0.00

Joomla! <1.5 RC4 - CSRF

Multiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) upload an extension containing arbitrary PHP code, and (3) modify the configuration as administrators via unspecified vectors.

CWE-352 Jan 04, 2008

CVE-2007-6490 1 PoC Analysis EPSS 0.01

Falcon Series One CMS 1.4.3 - CSRF

Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain changepass action to index.php.

CWE-352 Dec 20, 2007

CVE-2007-6390 EPSS 0.00

mycalendar <0.13 - CSRF

Cross-site request forgery (CSRF) vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform actions as blog administrators, which can be leveraged to conduct cross-site scripting (XSS) attacks on the blog page.

CWE-352 Dec 17, 2007

CVE-2007-6410 EPSS 0.00

Gadu-Gadu - CSRF

Gadu-Gadu does not properly perform protocol handling, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and add arbitrary user accounts or cause a denial of service as administrators via an unspecified "crafted link," possibly related to the gg protocol.

CWE-352 Dec 17, 2007

CVE-2007-6320 EPSS 0.00

Drupal Module <20071206 - CSRF

Feature 4.7.x-dev and 5.x-dev before 20071206, a Drupal module, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks.

CWE-352 Dec 12, 2007

CVE-2007-6300 EPSS 0.00

Fusion News 3.9.0 - CSRF

Cross-site request forgery (CSRF) vulnerability in Fusion News 3.9.0 allows remote attackers to perform unauthorized actions via unspecified vectors.

CWE-352 Dec 10, 2007

CVE-2007-6087 1 PoC Analysis EPSS 0.00

VigileCMS 1.4 - CSRF

Cross-site request forgery (CSRF) vulnerability in index.php in VigileCMS 1.4 allows remote attackers to change the admin password via certain parameters to the changepass module.

CWE-352 Nov 22, 2007

CVE-2007-5917 EPSS 0.00

Skalinks <1.5 - CSRF

Cross-site request forgery (CSRF) vulnerability in admin/admin_account.php in Skalinks 1.5 and earlier allows remote attackers to add arbitrary privileged accounts as administrators via the admin_name, admin_password, admin_type, and Add_admin parameters.

CWE-352 Nov 10, 2007

CVE-2007-5918 1 PoC Analysis EPSS 0.00

MS TopSites - CSRF

Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php.

CWE-352 Nov 10, 2007

CVE-2007-5828 EPSS 0.00

Django 0.96 - CSRF

Cross-site request forgery (CSRF) vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CSRF protection module that is included with the product. However, CVE considers this an issue because the default configuration does not use this module

CWE-352 Nov 05, 2007

CVE-2007-5818 EPSS 0.00

sBlog 0.7.3 Beta - CSRF

Cross-site request forgery (CSRF) vulnerability in blocks_edit_do.php in sBlog 0.7.3 Beta allows remote attackers to change arbitrary blocks as administrators.

CWE-352 Nov 05, 2007

CVE-2007-5799 EPSS 0.00

IBM WebSphere Application Server <6.1.0.13 - CSRF

Multiple cross-site request forgery (CSRF) vulnerabilities in uddigui/navigateTree.do in the UDDI user console in IBM WebSphere Application Server (WAS) before 6.1.0 Fix Pack 13 (6.1.0.13) allow remote attackers to perform some actions as WAS UDDI users via the (1) keyField, (2) nameField, (3) valueField, and (4) frameReturn parameters.

CWE-352 Nov 03, 2007

CVE-2007-5773 1 PoC Analysis EPSS 0.01

Flatnuke3 - CSRF

Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform certain actions as administrators via requests containing the pathname in the dir parameter and the filename in the ffile parameter.

CWE-352 Nov 01, 2007

CVE-2007-5594 EPSS 0.01

Drupal < 5.3 - CSRF

Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.

CWE-352 Oct 19, 2007

CVE-2007-5572 EPSS 0.00

Sphpblog - CSRF

Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Blog (SPHPBlog) 0.4.9 allow remote attackers to perform delete actions as administrators via (1) the block_id parameter to add_block.php or (2) the link_id parameter to add_link.php.

CWE-352 Oct 18, 2007

CVE-2007-5575 EPSS 0.00

Treble Designs 1024 Cms - CSRF

Cross-site request forgery (CSRF) vulnerability in 1024 CMS 1.2.5 allows remote attackers to perform some actions as administrators, as demonstrated by (1) an unspecified action that creates a file containing PHP code and (2) unspecified use of the forum component. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-352 Oct 18, 2007

CVE-2007-5384 EPSS 0.00

Alcatel Speedtouch 7G Router - CSRF

Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session. NOTE: SpeedTouch 780 might also be affected by some of these issues.

CWE-352 Oct 12, 2007

CVE-2007-5251 EPSS 0.00

Webhost Automation Helm Web Hosting Control Panel - CSRF

Multiple cross-site scripting (XSS) vulnerabilities in Helm 3.2.16 allow remote attackers to inject arbitrary web script or HTML via (1) the showOption parameter to domain.asp, or the (2) Folder or (3) StartPath parameter to FileManager.asp.

CWE-352 Oct 06, 2007

CVE-2007-5259 EPSS 0.00

Ilient Sysaid - CSRF

Cross-site request forgery (CSRF) vulnerability in Ilient SysAid 4.5.03 and 4.5.04 allows remote attackers to perform some actions as administrators, as demonstrated by changing the administrator password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-352 Oct 06, 2007