CVE & Exploit Intelligence Database

Updated 1h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

338,896 CVEs tracked 53,334 with exploits 4,742 exploited in wild 1,545 CISA KEV 3,939 Nuclei templates 49,053 vendors 42,729 researchers

42,527 results Clear all

CVE-2011-4540 1 PoC Analysis EPSS 0.05

Atmail Open - XSS

Multiple cross-site scripting (XSS) vulnerabilities in AtMail Open (aka AtMail Open-Source edition) 1.04 allow remote attackers to inject arbitrary web script or HTML via the func parameter to (1) ldap.php or (2) search.php.

CWE-79 Dec 01, 2011

CVE-2011-4344 EPSS 0.00

Jenkins <1.438-1.409.3 LTS - XSS

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

CWE-79 Dec 01, 2011

CVE-2011-2461 3 PoCs Analysis EPSS 0.04

Adobe Flex SDK - XSS

Cross-site scripting (XSS) vulnerability in the Adobe Flex SDK 3.x and 4.x before 4.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to the loading of modules from different domains.

CWE-79 Dec 01, 2011

CVE-2011-4647 EPSS 0.00

Multiple cross-site scripting (XSS) vulnerabilities in the story creation feature in Geeklog 1.8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) code or (2) raw BBcode tags.

CWE-79 Nov 30, 2011

CVE-2011-4345 EPSS 0.00

Namazu <2.0.21 - XSS

Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie.

CWE-79 Nov 30, 2011

CVE-2011-4572 1 PoC Analysis EPSS 0.00

Codefuture CF Image Hosting Script - XSS

Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably other versions before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this was originally reported as a file disclosure vulnerability, but this is likely inaccurate.

CWE-79 Nov 29, 2011

CVE-2011-4568 EPSS 0.00

Foliovision FV Wordpress Flowplayer Plugin < 1.12.11 - XSS

Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.

CWE-79 Nov 29, 2011

CVE-2011-4567 1 PoC Analysis EPSS 0.00

Zen-cart Zen Cart < 1.3.9 - XSS

Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547.

CWE-79 Nov 29, 2011

CVE-2011-4547 EPSS 0.00

Zen-cart Zen Cart - XSS

Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) main_page parameter or (2) PATH_INFO, a different vulnerability than CVE-2011-4567.

CWE-79 Nov 29, 2011

CVE-2011-4541 1 PoC Analysis EPSS 0.03

Hastymail2 - XSS

Cross-site scripting (XSS) vulnerability in index.php in Hastymail2 2.1.1 before RC2 allows remote attackers to inject arbitrary web script or HTML via the rs parameter in a mailbox Drafts action.

CWE-79 Nov 29, 2011

CVE-2011-4565 EPSS 0.00

Xoops < 2.5.1.a - XSS

Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to include/formdhtmltextarea_preview.php or (2) img BBCODE tag within the message parameter to pmlite.php (aka Private Message). NOTE: some of these details are obtained from third party information.

CWE-79 Nov 28, 2011

CVE-2011-4564 1 PoC Analysis EPSS 0.00

Activedev Active Cms - XSS

Cross-site scripting (XSS) vulnerability in the admin script in Active CMS 1.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter in a module action.

CWE-79 Nov 28, 2011

CVE-2011-4563 EPSS 0.00

Cross-site scripting (XSS) vulnerability in index.php in JAKCMS 2.0.4.1, and possibly other versions before 2.2.6 2011-09-23, allows remote attackers to inject arbitrary web script or HTML via the userpost parameter in a PM request, related to tinymce. NOTE: some of these details are obtained from third party information.

CWE-79 Nov 28, 2011

CVE-2011-4562 EPSS 0.00

John Godley Redirection Plugin - XSS

Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.

CWE-79 Nov 28, 2011

CVE-2011-4561 1 PoC Analysis EPSS 0.00

Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information.

CWE-79 Nov 28, 2011

CVE-2011-4560 EPSS 0.00

Drupal Petition Node Module - XSS

Cross-site scripting (XSS) vulnerability in the Petition Node module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to signing a petition.

CWE-79 Nov 28, 2011

CVE-2011-4335 1 PoC Analysis EPSS 0.00

Contao <2.10.2 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) teachers.html or (2) teachers/ action.

CWE-79 Nov 28, 2011

CVE-2011-4329 EPSS 0.00

Dolibarr 3.1.0 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter in a setup action to admin/company.php, or the PATH_INFO to (2) admin/security_other.php, (3) admin/events.php, or (4) admin/user.php.

CWE-79 Nov 28, 2011

CVE-2011-4319 EPSS 0.01

Ruby on Rails <3.0.11 & <3.1.2 - XSS

Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.

CWE-79 Nov 28, 2011

CVE-2011-4275 EXPLOITED 6 PoCs Analysis EPSS 0.01

iTop 1.1.181-1.2.0-RC-282 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted company name, (2) a crafted database server name, (3) a crafted CSV file, (4) a crafted copy-and-paste action, (5) the auth_user parameter in a suggest_pwd action to UI.php, (6) the c[menu] parameter to UniversalSearch.php, (7) the description parameter in a SearchFormToAdd_document_list action to UI.php, (8) the category parameter in an errors action to audit.php, or (9) the suggest_pwd parameter to UI.php.

CWE-79 Nov 26, 2011