Critical Vulnerabilities with Public Exploits
Updated 6h agoSearch and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.
4,101 results
Clear all
CVE-2017-17643
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.02
Lynda Clone - SQL Injection
FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.
CWE-89
Dec 18, 2017
CVE-2017-10682
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.00
Piwigo < 2.9.1 - SQL Injection
SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
CWE-89
Jun 29, 2017
CVE-2017-17872
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.01
Jextn Video Gallery - SQL Injection
The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action.
CWE-89
Dec 27, 2017
CVE-2017-17871
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.01
Jextn Question And Answer - SQL Injection
The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action, or the ques-srch parameter.
CWE-89
Dec 27, 2017
CVE-2017-17672
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.15
Vbulletin < 5.3.3 - Insecure Deserialization
In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
CWE-502
Dec 14, 2017
CVE-2017-17870
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Jbuildozer - SQL Injection
The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action.
CWE-89
Dec 27, 2017
CVE-2017-16949
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.39
AccessKeys AccessPress Anonymous Post Pro <3.1.9 - Code Injection
An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and file-uploader/file-uploader-class.php. This allows the attacker to upload anything they want to the server, as demonstrated by an action=ap_file_upload_action&allowedExtensions[]=php request to /wp-admin/admin-ajax.php that results in a .php file upload and resultant PHP code execution.
CWE-434
Dec 19, 2017
CVE-2017-17873
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.01
Vanguard Marketplace Digital Products Php - SQL Injection
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.
CWE-89
Dec 27, 2017
CVE-2017-17642
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Basic Job Site Script - SQL Injection
Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.
CWE-89
Dec 13, 2017
CVE-2017-17641
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Resume Clone Script - SQL Injection
Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.
CWE-89
Dec 13, 2017
CVE-2017-17640
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Advanced World Database - SQL Injection
Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter.
CWE-89
Dec 13, 2017
CVE-2017-17639
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Muslim Matrimonial Script - SQL Injection
Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.
CWE-89
Dec 13, 2017
CVE-2017-17638
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Groupon Clone Script - SQL Injection
Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.
CWE-89
Dec 13, 2017
CVE-2017-17637
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Car Rental Script - SQL Injection
Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
CWE-89
Dec 13, 2017
CVE-2017-17636
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Mlm Forced Matrix - SQL Injection
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
CWE-89
Dec 13, 2017
CVE-2017-17635
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Mlm Forex Market Plan Script - SQL Injection
MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.
CWE-89
Dec 13, 2017
CVE-2017-17634
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Single Theater Booking Script - SQL Injection
Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
CWE-89
Dec 13, 2017
CVE-2017-17633
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Multiplex Movie Theater Booking Script - SQL Injection
Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid parameter.
CWE-89
Dec 13, 2017
CVE-2017-17632
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Responsive Events And Movie Ticket Booking Script - SQL Injection
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
CWE-89
Dec 13, 2017
CVE-2017-17631
9.8
CRITICAL
1 PoC
Analysis
EPSS 0.03
Multireligion Responsive Matrimonial - SQL Injection
Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.
CWE-89
Dec 13, 2017