Exploit Intelligence Platform

Updated 2h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

339,175 CVEs tracked 53,341 with exploits 4,746 exploited in wild 1,546 CISA KEV 3,943 Nuclei templates 49,090 vendors 42,769 researchers

42,551 results Clear all

CVE-2012-4600 2 PoCs Analysis EPSS 0.07

OTRS Help Desk <2.4.14-3.0.16-3.1.10 - XSS

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with nested HTML tags.

CWE-79 Aug 31, 2012

CVE-2011-5132 EPSS 0.00

Mybb < 1.6.4 - XSS

Cross-site scripting (XSS) vulnerability in MyBB before 1.6.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "usernames via AJAX."

CWE-79 Aug 30, 2012

CVE-2012-1956 EPSS 0.01

Mozilla Firefox < 14.0 - XSS

Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.

CWE-79 Aug 29, 2012

CVE-2012-0307 EPSS 0.01

Symantec Messaging Gateway <10.0 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Symantec Messaging Gateway (SMG) before 10.0 allow remote attackers to inject arbitrary web script or HTML via (1) web content or (2) e-mail content.

CWE-79 Aug 29, 2012

CVE-2011-5128 EPSS 0.00

Bueltge Adminimize < 1.7.21 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3) inc-options/im_export_options.php, or the (4) post or (5) post_ID parameters to adminimize.php, different vectors than CVE-2011-4926.

CWE-79 Aug 29, 2012

CVE-2011-4926 EXPLOITED 1 PoC Analysis NUCLEI EPSS 0.07

Bueltge Adminimize < 1.7.21 - XSS

Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

CWE-79 Aug 29, 2012

CVE-2011-4918 2 PoCs Analysis EPSS 0.01

Elxis Cms - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Elxis CMS 2009.2, 2009.3 and 2009.3 Aphrodite before revision 2684 allow remote attackers to inject arbitrary web script or HTML via the (1) task parameter to elxis/index.php, and (2) PATH_INFO to elxis/administrator/index.php.

CWE-79 Aug 29, 2012

CVE-2012-4685 1 PoC Analysis EPSS 0.01

Arbor Networks Peakflow <5.1.1-5.6.0 - XSS

Cross-site scripting (XSS) vulnerability in Arbor Networks Peakflow SP 5.1.1 before patch 6, 5.5 before patch 4, and 5.6.0 before patch 1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.

CWE-79 Aug 28, 2012

CVE-2012-1647 EPSS 0.01

Mediafront - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via (1) $_SERVER['HTTP_HOST'] or (2) $_SERVER['SCRIPT_NAME'] to players/osmplayer/player/OSMPlayer.php, (3) playlist parameter to players/osmplayer/player/getplaylist.php, and possibly other vectors related to $_SESSION.

CWE-79 Aug 28, 2012

CVE-2012-4679 1 PoC Analysis EPSS 0.11

Newscoop <3.5.5 - XSS

Cross-site scripting (XSS) vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the f_user_name parameter.

CWE-79 Aug 27, 2012

CVE-2012-2129 EPSS 0.01

Andreas Gohr Dokuwiki - XSS

Cross-site scripting (XSS) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action.

CWE-79 Aug 27, 2012

CVE-2012-2112 EPSS 0.01

Typo3 < 4.4.15 - XSS

Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.

CWE-79 Aug 27, 2012

CVE-2012-1935 1 PoC Analysis EPSS 0.08

Sourcefabric Newscoop - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote attackers to inject arbitrary web script or HTML via the (1) Back parameter to admin/ad.php, or the (2) token or (3) f_email parameter to admin/password_check_token.php.

CWE-79 Aug 27, 2012

CVE-2012-2297 EPSS 0.00

Creative Commons Module Creativecommons - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the Creative Commons module 6.x-1.x before 6.x-1.1 for Drupal allow remote authenticated users with the administer creative commons permission to inject arbitrary web script or HTML via the (1) creativecommons_user_message or (2) creativecommons_site_license_additional_text parameter.

CWE-79 Aug 26, 2012

CVE-2012-1296 EPSS 0.01

Elefantcms < 1.1.4_beta - XSS

Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body parameter to admin/preview.

CWE-79 Aug 26, 2012

CVE-2011-5125 EPSS 0.00

Bluecoat Director < 5.5.2 - XSS

Cross-site scripting (XSS) vulnerability in Blue Coat Director before 5.5.2.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving the HTTP TRACE method.

CWE-79 Aug 26, 2012

CVE-2010-5192 EPSS 0.00

Blue Coat ProxySG <4.3.4.1-6.1.1.1 - XSS

Cross-site scripting (XSS) vulnerability in the Java Management Console in Blue Coat ProxySG before SGOS 4.3.4.1, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x before SGOS 6.1.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Aug 26, 2012

CVE-2012-4675 EPSS 0.00

PluXml 5.1.6 - XSS

Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update.

CWE-79 Aug 26, 2012

CVE-2010-5095 EPSS 0.01

SilverStripe <2.3.6 - XSS

Cross-site scripting (XSS) vulnerability in SilverStripe 2.3.x before 2.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to DataObjectSet pagination.

CWE-79 Aug 26, 2012

CVE-2012-4668 1 PoC Analysis EPSS 0.05

Roundcube Webmail <0.8.1 - XSS

Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.

CWE-79 Aug 25, 2012