CVE & Exploit Intelligence Database

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

338,933 CVEs tracked 53,338 with exploits 4,743 exploited in wild 1,546 CISA KEV 3,941 Nuclei templates 49,062 vendors 42,736 researchers

42,532 results Clear all

CVE-2012-0220 EPSS 0.00

Ikiwiki < 3.20120419 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the meta plugin (Plugin/meta.pm) in ikiwiki before 3.20120516 allow remote attackers to inject arbitrary web script or HTML via the (1) author or (2) authorurl meta tags.

CWE-79 May 29, 2012

CVE-2012-2941 1 PoC Analysis EPSS 0.02

Yandex.Server 2010 9.0 Enterprise - XSS

Cross-site scripting (XSS) vulnerability in search/ in Yandex.Server 2010 9.0 Enterprise allows remote attackers to inject arbitrary web script or HTML via the text parameter.

CWE-79 May 27, 2012

CVE-2012-2938 1 PoC Analysis EPSS 0.07

Travelon Express 6.2.2 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the holiday name field to (1) holiday_add.php or (2) holiday_view.php.

CWE-79 May 27, 2012

CVE-2012-2936 EPSS 0.01

Pligg CMS <1.2.2 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) page parameter to (a) admin/admin_comments.php or (b) admin/admin_links.php; or list parameter in a (3) move or (4) minimize action to (c) admin/admin_index.php.

CWE-79 May 27, 2012

CVE-2012-2436 1 PoC Analysis EPSS 0.03

Pligg CMS <1.2.2 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter in a move or (2) minimize action to admin/admin_index.php; (3) the karma_username parameter to module.php in the karma module; (4) q_1_low, (5) q_1_high, (6) q_2_low, or (7) q_2_high parameter in a configure action to module.php in the captcha module; or (8) the edit parameter to module.php in the admin_language module.

CWE-79 May 27, 2012

CVE-2012-2935 EPSS 0.00

OSCommerce Online Merchant 3.0.2 - XSS

Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Checkout/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, a different vulnerability than CVE-2012-1059.

CWE-79 May 27, 2012

CVE-2012-2235 EPSS 0.00

Sitracker Support Incident Tracker < 3.65 - XSS

Cross-site scripting (XSS) vulnerability in Support Incident Tracker (SiT!) 3.65 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to index.php, which is not properly handled in an error message.

CWE-79 May 27, 2012

CVE-2012-1792 EPSS 0.00

Oscommerce Online Merchant - XSS

Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message. NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges.

CWE-79 May 27, 2012

CVE-2012-1413 EPSS 0.00

Zen-cart Zen Cart - XSS

Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to zc_install/index.php.

CWE-79 May 27, 2012

CVE-2012-2759 EPSS 0.00

WordPress <3.0.4.1 - XSS

Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php.

CWE-79 May 22, 2012

CVE-2012-1990 1 PoC Analysis EPSS 0.01

Schneider-electric Kerweb < 3.0 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric Kerweb before 3.0.1 and Kerwin before 6.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the evtvariablename parameter in an evts.xml action to kw.dll, (2) unspecified search fields, or (3) unspecified content-display fields.

CWE-79 May 22, 2012

CVE-2012-2920 EPSS 0.00

WordPress User Photo <0.9.5.2 - XSS

Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plugin before 0.9.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.

CWE-79 May 21, 2012

CVE-2012-2918 1 PoC Analysis EPSS 0.04

Chevereto 1.91 - XSS

Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HTML via the v parameter.

CWE-79 May 21, 2012

CVE-2012-2339 EPSS 0.01

Drupal Glossary <6.x-1.8 - XSS

Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "taxonomy information."

CWE-79 May 21, 2012

CVE-2012-0296 EPSS 0.01

Symantec Web Gateway <5.0.3 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 May 21, 2012

CVE-2010-5100 EPSS 0.00

TYPO3 <4.2.16-4.4.5 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 May 21, 2012

CVE-2010-5098 EPSS 0.00

TYPO3 <4.2.16-4.4.5 - XSS

Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 May 21, 2012

CVE-2010-5097 EPSS 0.01

TYPO3 <4.3.9-4.4.5 - XSS

Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 May 21, 2012

CVE-2012-2917 1 PoC Analysis EPSS 0.01

WordPress Share and Follow <1.80.3 - XSS

Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.

CWE-79 May 21, 2012

CVE-2012-2916 EPSS 0.00

WordPress <2.1 - XSS

Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.

CWE-79 May 21, 2012