CVE & Exploit Intelligence Database

Updated 6h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

338,552 CVEs tracked 53,317 with exploits 4,732 exploited in wild 1,543 CISA KEV 3,938 Nuclei templates 48,973 vendors 42,623 researchers

42,490 results Clear all

CVE-2009-4149 EPSS 0.00

CA Service Desk 12.1 - XSS

Cross-site scripting (XSS) vulnerability in the web interface in CA Service Desk 12.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

CWE-79 Dec 09, 2009

CVE-2009-4234 1 PoC Analysis EPSS 0.01

Micronet Network Access Controller SP1910 - XSS

Cross-site scripting (XSS) vulnerability in loginpages/error_user.shtml on the Micronet Network Access Controller SP1910 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

CWE-79 Dec 08, 2009

CVE-2009-4233 EPSS 0.00

Joomla! mod_yj_whois - XSS

Cross-site scripting (XSS) vulnerability in modules/mod_yj_whois.php in the YJ Whois component 1.0x and 1.5.x for Joomla! allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php. NOTE: some of these details are obtained from third party information.

CWE-79 Dec 08, 2009

CVE-2009-4214 EPSS 0.02

Ruby on Rails <2.2.s & <2.3.5 - XSS

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

CWE-79 Dec 07, 2009

CVE-2009-4209 1 PoC Analysis EPSS 0.00

MoziloCMS 1.11.1 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) file parameters in an editsite action, different vectors than CVE-2008-6127 and CVE-2009-1367.

CWE-79 Dec 04, 2009

CVE-2009-4207 EPSS 0.00

Drupal Webform <5.x-2.7 & 6.x-2.7 - XSS

Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.7 and 6.x before 6.x-2.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a submission.

CWE-79 Dec 04, 2009

CVE-2009-4196 1 PoC Analysis EPSS 0.01

Huawei MT882 V100R002B020 ARG-T 3.7.9.98 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 allow remote attackers to inject arbitrary web script or HTML via the (1) BackButton parameter to error_1; (2) wzConnFlag parameter to fresh_pppoe_1; (3) diag_pppindex_argen and (4) DiagStartFlag parameters to rpDiag_argen_1; (5) wzdmz_active and (6) wzdmzHostIP parameters to rpNATdmz_argen_1; (7) wzVIRTUALSVR_endPort, (8) wzVIRTUALSVR_endPortLocal, (9) wzVIRTUALSVR_IndexFlag, (10) wzVIRTUALSVR_localIP, (11) wzVIRTUALSVR_startPort, and (12) wzVIRTUALSVR_startPortLocal parameters to rpNATvirsvr_argen_1; (13) Connect_DialFlag, (14) Connect_DialHidden, and (15) Connect_Flag parameters to rpStatus_argen_1; (16) Telephone_select, and (17) wzFirstFlag parameters to rpwizard_1; and (18) wzConnectFlag parameter to rpwizPppoe_1.

CWE-79 Dec 04, 2009

CVE-2009-4187 EPSS 0.00

Sun Java System Portal Server - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the Gateway component in Sun Java System Portal Server 6.3.1, 7.1, and 7.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Dec 03, 2009

CVE-2009-4172 2 PoCs Analysis EPSS 0.01

CutePHP CuteNews <1.4.6 - XSS

Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action.

CWE-79 Dec 02, 2009

CVE-2009-4169 EPSS 0.00

WordPress <1.22 - XSS

Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Dec 02, 2009

CVE-2009-4168 1 PoC Analysis EPSS 0.05

Roy Tanck tagcloud.swf - XSS

Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.

CWE-79 Dec 02, 2009

CVE-2009-4164 EPSS 0.00

TYPO3 simple Glossar <1.0.3 - XSS

Cross-site scripting (XSS) vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Dec 02, 2009

CVE-2009-4161 EPSS 0.00

[AN] Search it! <2.4.1 - XSS

Cross-site scripting (XSS) vulnerability in the [AN] Search it! (an_searchit) extension 2.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Dec 02, 2009

CVE-2009-4159 EPSS 0.00

TYPO3 direct_mail <2.6.4 - XSS

Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Dec 02, 2009

CVE-2009-4157 1 PoC Analysis EPSS 0.00

Joomla! com_proofreader <1.0 RC9 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9 and earlier for Joomla! allow remote attackers to inject arbitrary web script or HTML via the URI, which is not properly handled in (1) 404 or (2) error pages.

CWE-79 Dec 02, 2009

CVE-2009-4152 EPSS 0.00

IBM WebSphere Portal <6.1.0.3 - XSS

Cross-site scripting (XSS) vulnerability in the Collaboration component in IBM WebSphere Portal 6.1.x before 6.1.0.3 allows remote attackers to inject arbitrary web script or HTML via the people picker tag.

CWE-79 Dec 02, 2009

CVE-2009-4119 EPSS 0.00

Drupal Feed Element Mapper <6.2.0-alpha4 - XSS

Cross-site scripting (XSS) vulnerability in Feed Element Mapper module 5.x before 5.x-1.3, 6.x before 6.x-1.3, and 6.x-2.0-alpha before 6.x-2.0-alpha4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Dec 01, 2009

CVE-2009-4110 EPSS 0.00

DotNetNuke <5.1.4 - XSS

Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page.

CWE-79 Nov 29, 2009

CVE-2009-4093 1 PoC Analysis EPSS 0.02

Simplog 0.9.3.2 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) cname (Name) or (2) email parameters.

CWE-79 Nov 29, 2009

CVE-2009-4087 EPSS 0.00

telepark.wiki <2.4.23 - XSS

Cross-site scripting (XSS) vulnerability in index.php in telepark.wiki 2.4.23 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

CWE-79 Nov 29, 2009