Exploit Intelligence Platform

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

339,076 CVEs tracked 53,339 with exploits 4,745 exploited in wild 1,546 CISA KEV 3,941 Nuclei templates 49,076 vendors 42,752 researchers

42,546 results Clear all

CVE-2012-3465 EPSS 0.00

Rails < 3.0.16 - XSS

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

CWE-79 Aug 10, 2012

CVE-2012-3464 EPSS 0.00

Rails < 3.0.16 - XSS

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

CWE-79 Aug 10, 2012

CVE-2012-3463 EPSS 0.00

Rails < 3.0.17 - XSS

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.

CWE-79 Aug 10, 2012

CVE-2012-4004 EPSS 0.00

Fenrir-inc Sleipnir Mobile < 2.2.0 - XSS

Cross-site scripting (XSS) vulnerability in the Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allows remote attackers to inject arbitrary web script or HTML via a crafted application that interacts with an unspecified Sleipnir Mobile function.

CWE-79 Aug 08, 2012

CVE-2012-2960 EPSS 0.01

HP Arcsight Connector Appliance Firmware - XSS

Cross-site scripting (XSS) vulnerability in the import functionality in HP ArcSight Connector appliance 6.2.0.6244.0 and ArcSight Logger appliance 5.2.0.6288.0 allows remote attackers to inject arbitrary web script or HTML via a crafted file.

CWE-79 Aug 08, 2012

CVE-2012-2648 EPSS 0.00

GoodReader <3.16 - XSS

Cross-site scripting (XSS) vulnerability in the GoodReader app 3.16 and earlier for iOS on the iPad, and 3.15.1 and earlier for iOS on the iPhone and iPod touch, allows remote attackers to inject arbitrary web script or HTML via vectors involving use of this app in conjunction with a web browser.

CWE-79 Aug 07, 2012

CVE-2012-2022 EPSS 0.01

HP Network Node Manager I - XSS

Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i (NNMi) 8.x, 9.0x, 9.1x, and 9.20 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Aug 07, 2012

CVE-2012-4144 EPSS 0.00

Opera Browser < 12.00 - XSS

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, does not properly escape characters in DOM elements, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted HTML document.

CWE-79 Aug 06, 2012

CVE-2012-4142 EPSS 0.00

Opera Browser < 12.00 - XSS

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.

CWE-79 Aug 06, 2012

CVE-2012-3442 EPSS 0.00

Django < 1.3 - XSS

The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.

CWE-79 Jul 31, 2012

CVE-2012-3848 1 PoC Analysis EPSS 0.01

Sonicwall Scrutinizer < 9.5.0 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php.

CWE-79 Jul 31, 2012

CVE-2012-4043 EPSS 0.00

Palo Alto Global Protected Gateway - XSS

Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals 3.1.x through 3.1.11 and 4.0.x through 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the inputStr parameter in a Login action.

CWE-79 Jul 26, 2012

CVE-2012-4058 EPSS 0.00

Socketmail - XSS

Cross-site scripting (XSS) vulnerability in SocketMail Pro 2.2.9 allows remote attackers to inject arbitrary web script or HTML via the subject of an email.

CWE-79 Jul 25, 2012

CVE-2012-2310 EPSS 0.00

Oleg Kovalchuk Cctags - XSS

Cross-site scripting (XSS) vulnerability in the cctags module for Drupal 6.x-1.x before 6.x-1.10 and 7.x-1.x before 7.x-1.10 allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Jul 25, 2012

CVE-2012-2309 EPSS 0.00

Wearepropeople Glossify Internal Links Auto Seo < 6.x-2.5 - XSS

Cross-site scripting (XSS) vulnerability in the Glossify Internal Links Auto SEO module for Drupal 6.x-2.5 and earlier allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Jul 25, 2012

CVE-2012-2308 EPSS 0.00

Tahiticlic Taxonomy Grid Catalog < 6.x-1.6 - XSS

Cross-site scripting (XSS) vulnerability in the Taxonomy Grid : Catalog module for Drupal 6.x-1.6 and earlier allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Jul 25, 2012

CVE-2012-3695 EPSS 0.00

Apple Safari < 5.1.7 - XSS

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML by leveraging improper URL canonicalization during the handling of the location.href property.

CWE-79 Jul 25, 2012

CVE-2012-0678 EPSS 0.00

Apple Safari <6.0 - XSS

Cross-site scripting (XSS) vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL.

CWE-79 Jul 25, 2012

CVE-2012-3396 EPSS 0.00

Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2365.

CWE-79 Jul 23, 2012

CVE-2012-3393 EPSS 0.00

Cross-site scripting (XSS) vulnerability in repository/lib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 allows remote authenticated administrators to inject arbitrary web script or HTML by renaming a repository.

CWE-79 Jul 23, 2012