Latest Vulnerabilities with Public Exploits

Updated 3h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

352,204 CVEs tracked 54,186 with exploits 4,985 exploited in wild 1,603 CISA KEV 4,139 Nuclei templates 54,578 vendors 46,821 researchers

54,186 results Clear all

CVE-2009-0701 1 PoC Analysis EPSS 0.03

Cybershade CMS 0.2b - Remote Code Execution via THEME_header and THEME_footer Parameters

Multiple PHP remote file inclusion vulnerabilities in index.php in Cybershade CMS 0.2b, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) THEME_header and (2) THEME_footer parameters.

CWE-94 Feb 23, 2009 STIX 2.1

CVE-2009-0108 1 PoC Analysis EPSS 0.03

PHPAuctions - Unauthenticated Authentication Bypass via Cookie Manipulation

PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via modified (1) PHPAUCTION_RM_ID, (2) PHPAUCTION_RM_NAME, (3) PHPAUCTION_RM_USERNAME, and (4) PHPAUCTION_RM_EMAIL cookies.

CWE-264 Jan 09, 2009 STIX 2.1

CVE-2009-0107 1 PoC Analysis EPSS 0.04

phpauctions - Cross-Site Scripting via profile.php user_id Parameter

Cross-site scripting (XSS) vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

CWE-79 Jan 09, 2009 STIX 2.1

CVE-2009-0106 1 PoC Analysis EPSS 0.01

phpauctions - SQL Injection via profile.php user_id Parameter

SQL injection vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to execute arbitrary SQL commands via the user_id parameter.

CWE-89 Jan 09, 2009 STIX 2.1

CVE-2009-0070 1 PoC Analysis EPSS 0.06

Apple Safari - Integer Signedness Error in JavaScript Function Arguments Array

Integer signedness error in Apple Safari allows remote attackers to read the contents of arbitrary memory locations, cause a denial of service (application crash), and probably have unspecified other impact via the array index of the arguments array in a JavaScript function, possibly a related issue to CVE-2008-2307.

CWE-189 Jan 08, 2009 STIX 2.1

CVE-2009-0704 1 PoC Analysis EPSS 0.00

WSN Guest 1.23 - SQL Injection via Search Parameter

SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands via the search parameter in an advanced action.

CWE-89 Feb 23, 2009 STIX 2.1

CVE-2009-0598 1 PoC Analysis EPSS 0.01

PhpMesFilms 1.0 and 1.8 - SQL Injection via id Parameter

SQL injection vulnerability in index.php in PhpMesFilms 1.0 and 1.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 Feb 16, 2009 STIX 2.1

CVE-2009-0593 1 PoC Analysis EPSS 0.00

plx Auto Reminder 3.7 - SQL Injection

SQL injection vulnerability in members.php in plx Auto Reminder 3.7 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a newar action.

CWE-89 Feb 16, 2009 STIX 2.1

CVE-2009-0592 1 PoC Analysis EPSS 0.49

PNphpBB2 <= 1.2i - Remote File Inclusion via ModName Parameter

Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.

CWE-22 Feb 16, 2009 STIX 2.1

CVE-2009-0596 1 PoC Analysis EPSS 0.04

phpSkelSite 1.4 - Remote File Inclusion via TplSuffix Parameter

Directory traversal vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the TplSuffix parameter.

CWE-22 Feb 16, 2009 STIX 2.1

CVE-2009-0595 1 PoC Analysis EPSS 0.12

phpSkelSite 1.4 - Remote Code Execution via Theme Parameter

PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter.

CWE-94 Feb 16, 2009 STIX 2.1

CVE-2009-0594 1 PoC Analysis EPSS 0.04

phpSkelSite 1.4 - Cross-Site Scripting via PATH_INFO

Cross-site scripting (XSS) vulnerability in index.php in phpSkelSite 1.4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

CWE-79 Feb 16, 2009 STIX 2.1

CVE-2009-0177 1 PoC Analysis EPSS 0.14

VMware Workstation/Player/ACE/Server/Fusion DoS via Long USER/PASS Command

vmwarebase.dll, as used in the vmware-authd service (aka vmware-authd.exe), in VMware Workstation 6.5.1 build 126130, 6.5.1 and earlier; VMware Player 2.5.1 build 126130, 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 2.0.x before 2.0.1 build 156745; and VMware Fusion before 2.0.2 build 147997 allows remote attackers to cause a denial of service (daemon crash) via a long (1) USER or (2) PASS command.

CWE-399 Jan 20, 2009 STIX 2.1

CVE-2009-0711 1 PoC Analysis EPSS 0.01

PHPFootball 1.6 - Exposure of Sensitive Information via dbtable and dbfield Parameters

filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.

CWE-200 Feb 23, 2009 STIX 2.1

CVE-2009-0707 1 PoC Analysis EPSS 0.00

PowerClan 1.14a - SQL Injection via Login Email Parameter

SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter (aka login field). NOTE: some of these details are obtained from third party information.

CWE-89 Feb 23, 2009 STIX 2.1

CVE-2009-0705 1 PoC Analysis EPSS 0.01

PowerScripts PowerNews <2.5.4 - SQL Injection

SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsid parameter.

CWE-89 Feb 23, 2009 STIX 2.1

CVE-2009-0703 1 PoC Analysis EPSS 0.00

ASPThai.Net Webboard 6.0 - SQL Injection

SQL injection vulnerability in bview.asp in ASPThai.Net Webboard 6.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 Feb 23, 2009 STIX 2.1

CVE-2009-0597 1 PoC Analysis EPSS 0.00

w3b_cms < 3.3.0 - SQL Injection via Username Parameter

SQL injection vulnerability in admin/index.php in w3b>cms (aka w3blabor CMS) before 3.4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the benutzername parameter (aka Username field) in a login action.

CWE-89 Feb 16, 2009 STIX 2.1

CVE-2009-0491 1 PoC Analysis EPSS 0.23

Elecard MPEG Player <5.5 - Buffer Overflow

Stack-based buffer overflow in Elecard MPEG Player 5.5 build 15884.081218 allows remote attackers to execute arbitrary code via a M3U file containing a long URL.

CWE-119 Feb 10, 2009 STIX 2.1

CVE-2009-2953 1 PoC Analysis EPSS 0.03

Mozilla Firefox 3.0.6-3.0.13 and 3.5.x - Denial of Service via Long Location Hash

Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote attackers to cause a denial of service (CPU consumption) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.

CWE-399 Aug 24, 2009 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps