Latest Vulnerabilities with Public Exploits

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

352,945 CVEs tracked 54,200 with exploits 4,987 exploited in wild 1,606 CISA KEV 4,144 Nuclei templates 54,660 vendors 46,865 researchers

54,200 results Clear all

CVE-2009-3509 1 PoC Analysis EPSS 0.03

CJ Dynamic Poll PRO 2.0 - Cross-Site Scripting via PATH_INFO

Cross-site scripting (XSS) vulnerability in admin/admin_index.php in CJ Dynamic Poll PRO 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

CWE-79 Oct 01, 2009 STIX 2.1

CVE-2009-2889 1 PoC Analysis EPSS 0.01

PHP Scripts Now Hangman - Cross-Site Scripting via Letters Parameter

Cross-site scripting (XSS) vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to inject arbitrary web script or HTML via the letters parameter.

CWE-79 Aug 20, 2009 STIX 2.1

CVE-2009-2888 1 PoC Analysis EPSS 0.00

PHP Scripts Now Hangman - SQL Injection via index.php n Parameter

SQL injection vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to execute arbitrary SQL commands via the n parameter.

CWE-89 Aug 20, 2009 STIX 2.1

CVE-2009-2564 2 PoCs Analysis EPSS 0.00

NOS Microsystems getPlus Download Manager - Privilege Escalation

NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.

CWE-264 Jul 21, 2009 STIX 2.1

CVE-2009-4876 1 PoC Analysis EPSS 0.02

Netrix CMS 1.0 - Unauthenticated Arbitrary Page Modification via cid Parameter

admin/cikkform.php in Netrix CMS 1.0 allows remote attackers to modify arbitrary pages via a direct request using the cid parameter.

CWE-264 May 26, 2010 STIX 2.1

CVE-2009-4693 1 PoC Analysis EPSS 0.01

GraFX MiniCWB 2.3.0 - Remote Code Execution via LANG Parameter File Inclusion

Multiple PHP remote file inclusion vulnerabilities in GraFX MiniCWB 2.3.0 allow remote attackers to execute arbitrary PHP code via a URL in the LANG parameter to (1) en.inc.php, (2) hu.inc.php, (3) no.inc.php, (4) ro.inc.php, and (5) ru.inc.php in language/.

CWE-94 Mar 10, 2010 STIX 2.1

CVE-2009-4687 1 PoC Analysis EPSS 0.00

Silentum Guestbook 2.0.2 - SQL Injection

SQL injection vulnerability in silentum_guestbook.php in Silentum Guestbook 2.0.2 allows remote attackers to execute arbitrary SQL commands via the messageid parameter.

CWE-89 Mar 10, 2010 STIX 2.1

CVE-2009-4686 1 PoC Analysis EPSS 0.02

phplemon AdQuick 2.2.1 - Cross-Site Scripting via red_url Parameter

Cross-site scripting (XSS) vulnerability in account.php in phplemon AdQuick 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the red_url parameter.

CWE-79 Mar 10, 2010 STIX 2.1

CVE-2009-4685 1 PoC Analysis EPSS 0.02

PHP Scripts Now Astrology - Cross-Site Scripting via Day Parameter

Cross-site scripting (XSS) vulnerability in celebrities.php in PHP Scripts Now Astrology allows remote attackers to inject arbitrary web script or HTML via the day parameter.

CWE-79 Mar 10, 2010 STIX 2.1

CVE-2009-4684 1 PoC Analysis EPSS 0.01

EZodiak - Cross-Site Scripting via Sign Parameter

Cross-site scripting (XSS) vulnerability in index.php in EZodiak allows remote attackers to inject arbitrary web script or HTML via the sign parameter.

CWE-79 Mar 10, 2010 STIX 2.1

CVE-2009-3858 1 PoC Analysis EPSS 0.02

GejoSoft - Cross-Site Scripting via PATH_INFO to photos/tags

Cross-site scripting (XSS) vulnerability in GejoSoft allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI in photos/tags.

CWE-79 Nov 04, 2009 STIX 2.1

CVE-2009-3810 1 PoC Analysis EPSS 0.13

Acoustica MP3 Audio Mixer 2.471 - Heap-Based Buffer Overflow via Long String in M3U Playlist File

Heap-based buffer overflow in Acoustica MP3 Audio Mixer 2.471 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long string in a .M3U playlist file.

CWE-119 Oct 27, 2009 STIX 2.1

CVE-2009-3809 1 PoC Analysis EPSS 0.05

Acoustica MP3 Audio Mixer 1.0 and 2.471 - Denial of Service via Long String in SGP Playlist File

Acoustica MP3 Audio Mixer 1.0 and possibly 2.471 allows remote attackers to cause a denial of service (crash) via a long string in a .sgp playlist file.

CWE-119 Oct 27, 2009 STIX 2.1

CVE-2009-3716 1 PoC Analysis EPSS 0.09

MCshoutbox 1.1 - Authenticated Arbitrary File Upload via Admin Panel

Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in smilies/.

CWE-264 Oct 16, 2009 STIX 2.1

CVE-2009-3715 1 PoC Analysis EPSS 0.00

MCshoutbox 1.1 - SQL Injection via Username or Password Parameter

Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

CWE-89 Oct 16, 2009 STIX 2.1

CVE-2009-3714 1 PoC Analysis EPSS 0.05

MCshoutbox 1.1 - Cross-Site Scripting via admin_login.php loginerror Parameter

Cross-site scripting (XSS) vulnerability in admin_login.php in MCshoutbox 1.1 allows remote attackers to inject arbitrary web script or HTML via the loginerror parameter.

CWE-79 Oct 16, 2009 STIX 2.1

CVE-2009-3599 1 PoC Analysis EPSS 0.01

HUBScript 1.0 - Cross-Site Scripting via bid_id Parameter

Cross-site scripting (XSS) vulnerability in single_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitrary web script or HTML via the bid_id parameter.

CWE-79 Oct 08, 2009 STIX 2.1

CVE-2009-3539 2 PoCs Analysis EPSS 0.01

YourFreeWorld Ultra Classifieds Pro - Cross-Site Scripting via cname or sn Parameter

Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Ultra Classifieds Pro allow remote attackers to inject arbitrary web script or HTML via the (1) cname parameter to subclass.php and the (2) sn parameter to listads.php.

CWE-79 Oct 02, 2009 STIX 2.1

CVE-2009-3536 1 PoC Analysis EPSS 0.08

EpicDJSoftware EpicVJ 1.2.8.0 and 1.3.1.2 - Stack-Based Buffer Overflow via Long String in Playlist File

Multiple stack-based buffer overflows in EpicDJSoftware EpicVJ 1.2.8.0 and 1.3.1.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a (1) .m3u or (2) .mpl playlist file.

CWE-119 Oct 02, 2009 STIX 2.1

CVE-2009-3512 3 PoCs Analysis EPSS 0.01

MyWeight 1.0 - Cross-Site Scripting via Multiple Parameters

Multiple cross-site scripting (XSS) vulnerabilities in MyWeight 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) date parameter to user_addfood.php, info parameter to (2) user_forgot_pwd_form.php and (3) user_login.php, and (4) return parameter to user_login.php.

CWE-79 Oct 01, 2009 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps