CVE & Exploit Intelligence Database

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

338,535 CVEs tracked 53,316 with exploits 4,732 exploited in wild 1,543 CISA KEV 3,936 Nuclei templates 48,971 vendors 42,621 researchers

42,489 results Clear all

CVE-2009-3266 EPSS 0.01

Opera Browser - XSS

Opera before 10.01 does not properly restrict HTML in a (1) RSS or (2) Atom feed, which allows remote attackers to conduct cross-site scripting (XSS) attacks, and conduct cross-zone scripting attacks involving the Feed Subscription Page to read feeds or create feed subscriptions, via a crafted feed, related to the rendering of the application/rss+xml content type as "scripted content."

CWE-79 Sep 18, 2009

CVE-2009-3265 EPSS 0.00

Opera Browser - XSS

Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers this behavior a "design feature," not a vulnerability.

CWE-79 Sep 18, 2009

CVE-2009-3263 EPSS 0.00

Google Chrome - XSS

Cross-site scripting (XSS) vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or (2) Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."

CWE-79 Sep 18, 2009

CVE-2009-3262 EPSS 0.00

IBM Tivoli Identity Manager - XSS

Cross-site scripting (XSS) vulnerability in the Self Service UI (SSUI) in IBM Tivoli Identity Manager (ITIM) 5.0.0.5 allows remote authenticated users to inject arbitrary web script or HTML via the last name field in a profile.

CWE-79 Sep 18, 2009

CVE-2009-3260 1 PoC Analysis EPSS 0.00

Livestreet - XSS

Cross-site scripting (XSS) vulnerability in LiveStreet 0.2 allows remote attackers to inject arbitrary web script or HTML via the header of the topic in a comment.

CWE-79 Sep 18, 2009

CVE-2009-3256 1 PoC Analysis EPSS 0.00

Livestreet - XSS

Cross-site scripting (XSS) vulnerability in include/ajax/blogInfo.php in LiveStreet 0.2 allows remote attackers to inject arbitrary web script or HTML via the URI, as demonstrated by a SCRIPT element in an arbitrary parameter such as the asd parameter.

CWE-79 Sep 18, 2009

CVE-2009-3247 1 PoC Analysis EPSS 0.05

Vtiger Crm - XSS

Cross-site scripting (XSS) vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the query_string vector is already covered by CVE-2008-3101.3.

CWE-79 Sep 18, 2009

CVE-2009-3240 EPSS 0.00

Ohwada Xf-section - XSS

Cross-site scripting (XSS) vulnerability in the Happy Linux XF-Section module 1.12a for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Sep 18, 2009

CVE-2009-2937 1 PoC Analysis EPSS 0.03

Intertwingly Planet - XSS

Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed.

CWE-79 Sep 18, 2009

CVE-2008-7242 1 PoC Analysis EPSS 0.00

MODx CMS 0.9.6.1-0.9.6.1p1 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the (1) search, (2) "a," (3) messagesubject, and (4) messagebody parameters to certain pages as reachable from manager/index.php; (5) highlight, (6) id, (7) email, (8) name, and (9) parent parameters to index.php; and the (10) docgrp and (11) moreResultsPage parameters to index-ajax.php.

CWE-79 Sep 17, 2009

CVE-2009-3237 EPSS 0.01

Horde Application Framework - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

CWE-79 Sep 17, 2009

CVE-2009-3227 EPSS 0.00

Almondsoft Affiliate Network Classifieds - XSS

Cross-site scripting (XSS) vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to inject arbitrary web script or HTML via the city parameter in a search action. NOTE: some of these details are obtained from third party information.

CWE-79 Sep 16, 2009

CVE-2009-3225 2 PoCs Analysis EPSS 0.01

Almondsoft Almond Classifieds - XSS

Multiple cross-site scripting (XSS) vulnerabilities in AlmondSoft Almond Classifieds Wap and Pro, and possibly Almond Affiliate Network Classifieds, allow remote attackers to inject arbitrary web script or HTML via (1) the page parameter in a browse action to index.php or (2) the addr parameter to gmap.php. NOTE: some of these details are obtained from third party information.

CWE-79 Sep 16, 2009

CVE-2009-3222 1 PoC Analysis EPSS 0.02

Freewebscriptz Honest Traffic - XSS

Cross-site scripting (XSS) vulnerability in index.php in FreeWebScriptz Honest Traffic (FWSHT) 1.x allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

CWE-79 Sep 16, 2009

CVE-2009-3210 EPSS 0.00

Joao Ventura Print - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.8 and 6.x before 6.x-1.8, a module for Drupal, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Sep 16, 2009

CVE-2009-3206 EPSS 0.00

Drewish Imagecache - XSS

Multiple cross-site scripting (XSS) vulnerabilities in the ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, allow remote authenticated users, with "administer imagecache" permissions, to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Sep 16, 2009

CVE-2009-3204 EPSS 0.00

Stivaforum Stiva Forum - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Stiva Forum 1.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) demo.php and (2) forum.php, and the PATH_INFO to (3) include_forum.php.

CWE-79 Sep 16, 2009

CVE-2009-3202 1 PoC Analysis EPSS 0.01

Uloki Php Forum - XSS

Cross-site scripting (XSS) vulnerability in search.php in ULoKI PHP Forum 2.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter.

CWE-79 Sep 16, 2009

CVE-2009-3198 EPSS 0.00

Jce-tech Affiliate Master Datafeed Parser - XSS

Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech Affiliate Master Datafeed Parser Script 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.

CWE-79 Sep 15, 2009

CVE-2009-3197 EPSS 0.00

Jce-tech Php Calendars Script - XSS

Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech PHP Calendars Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.

CWE-79 Sep 15, 2009