Exploit Intelligence Platform

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

339,501 CVEs tracked 53,335 with exploits 4,748 exploited in wild 1,551 CISA KEV 3,948 Nuclei templates 49,234 vendors 42,835 researchers

42,628 results Clear all

CVE-2014-4195 EPSS 0.00

ZeroCMS 1.0 - XSS

Cross-site scripting (XSS) vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to inject arbitrary web script or HTML via the article_id parameter.

CWE-79 Jul 03, 2014

CVE-2014-4002 EPSS 0.00

Cacti 0.8.8b - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6) graph_templates.php, (7) graphs.php, (8) host.php, or (9) host_templates.php or the (10) graph_template_input_id or (11) graph_template_id parameter to graph_templates_inputs.php.

CWE-79 Jul 03, 2014

CVE-2014-3149 EPSS 0.00

Invisioncommunity Invision Power Board - XSS

Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Jul 03, 2014

CVE-2014-2965 EPSS 0.01

Spamtitan < 6.03 - XSS

Cross-site scripting (XSS) vulnerability in auth-settings-x.php in SpamTitan before 6.04 allows remote attackers to inject arbitrary web script or HTML via the sortdir parameter.

CWE-79 Jul 03, 2014

CVE-2014-4606 EPSS 0.00

ZeenShare 1.0.1 - XSS

Cross-site scripting (XSS) vulnerability in redirect_to_zeenshare.php in the ZeenShare plugin 1.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the zs_sid parameter.

CWE-79 Jul 02, 2014

CVE-2014-4597 EPSS 0.00

WP Social Invitations <1.4.4.3 - XSS

Cross-site scripting (XSS) vulnerability in test.php in the WP Social Invitations plugin before 1.4.4.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xhrurl parameter.

CWE-79 Jul 02, 2014

CVE-2014-4591 EPSS 0.00

WP-Picasa-Image <1.0 - XSS

Cross-site scripting (XSS) vulnerability in picasa_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.

CWE-79 Jul 02, 2014

CVE-2014-4581 EPSS 0.00

WPCB <2.4.8 - XSS

Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

CWE-79 Jul 02, 2014

CVE-2014-4571 EPSS 0.00

VN-Calendar <1.0 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fs or (2) w parameter.

CWE-79 Jul 02, 2014

CVE-2014-4565 EPSS 0.00

WordPress vcc.js.php - XSS

Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) vp, (2) vs, (3) l, (4) vu, or (5) vm parameter.

CWE-79 Jul 02, 2014

CVE-2014-4563 EPSS 0.00

WordPress url-cloak-encrypt <2.0 - XSS

Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.

CWE-79 Jul 02, 2014

CVE-2014-4555 EPSS 0.00

Style It <1.0 - XSS

Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

CWE-79 Jul 02, 2014

CVE-2014-4554 EPSS 0.00

WordPress <1.5 - XSS

Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title parameter.

CWE-79 Jul 02, 2014

CVE-2014-4549 EPSS 0.00

WooCommerce SagePay Direct Payment Gateway <0.1.6.7 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.

CWE-79 Jul 02, 2014

CVE-2014-4546 EPSS 0.00

Rezgo plugin <1.4.2 - XSS

Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the response parameter.

CWE-79 Jul 02, 2014

CVE-2014-4534 EPSS 0.00

HTML5 Video Player with Playlist <2.4.0 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) theme or (2) playlistmod parameter.

CWE-79 Jul 02, 2014

CVE-2014-3737 EPSS 0.01

Storesprite < 7_24-04-13 - XSS

Cross-site scripting (XSS) vulnerability in templates/defaultheader.php in Lamp Design Storesprite before 7 - 19-06-14, when using the currency selection dropdown, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to brand.php, related to the currencyUrl function.

CWE-79 Jul 02, 2014

CVE-2014-4605 EPSS 0.00

ZdStatistics <2.0.1 - XSS

Cross-site scripting (XSS) vulnerability in cal/test.php in the ZdStatistics (zdstats) plugin 2.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

CWE-79 Jul 02, 2014

CVE-2014-4604 EPSS 0.00

Your Text Manager <0.3.0 - XSS

Cross-site scripting (XSS) vulnerability in settings/pwsettings.php in the Your Text Manager plugin 0.3.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the ytmpw parameter.

CWE-79 Jul 02, 2014

CVE-2014-4603 EPSS 0.00

Yahoo! Updates for WordPress <1.0 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in yupdates_application.php in the Yahoo! Updates for WordPress plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) secret, (2) key, or (3) appid parameter.

CWE-79 Jul 02, 2014