Latest Vulnerabilities with Public Exploits

Updated 3h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

352,078 CVEs tracked 54,218 with exploits 4,985 exploited in wild 1,602 CISA KEV 4,139 Nuclei templates 54,555 vendors 46,805 researchers

54,218 results Clear all

CVE-2008-5763 1 PoC Analysis EPSS 0.06

Simple Text-File Login Script <1.0.6 - RCE

PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows remote attackers to execute arbitrary PHP code via a URL in the slogin_path parameter.

CWE-94 Dec 30, 2008 STIX 2.1

CVE-2008-5762 1 PoC Analysis EPSS 0.06

Simple Text-File Login Script 1.0.6 - Info Disclosure

Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for slog_users.txt.

CWE-264 Dec 30, 2008 STIX 2.1

CVE-2008-5761 1 PoC Analysis EPSS 0.07

FlatnuX CMS 2008-12-11 - Cross-Site Scripting via mod foto or name Parameter

Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allow remote attackers to inject arbitrary web script or HTML via (1) the mod parameter to the default URI; (2) the foto parameter to photo.php in the 05_Foto module; or (3) the name parameter in an insertrecord action to index.php in the 08_Files module, as demonstrated by injection within a SRC attribute of an IFRAME element.

CWE-79 Dec 30, 2008 STIX 2.1

CVE-2008-5923 1 PoC Analysis EPSS 0.00

ASP-DEv XM Events Diary - SQL Injection

SQL injection vulnerability in default.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands the cat parameter.

CWE-89 Jan 21, 2009 STIX 2.1

CVE-2008-6883 1 PoC Analysis EPSS 0.00

com_livechat 1.0 - SQL Injection via last parameter to getChatRoom.php

SQL injection vulnerability in the Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-89 Jul 30, 2009 STIX 2.1

CVE-2008-6882 1 PoC Analysis EPSS 0.03

com_livechat 1.0 - Server-Side Request Forgery via xmlhttp.php Proxy

Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.

CWE-20 Jul 30, 2009 STIX 2.1

CVE-2008-6881 1 PoC Analysis EPSS 0.00

com_livechat 1.0 - SQL Injection via last Parameter

Multiple SQL injection vulnerabilities in the Live Chat (com_livechat) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to (1) getChat.php, (2) getChatRoom.php, and (3) getSavedChatRooms.php.

CWE-89 Jul 30, 2009 STIX 2.1

CVE-2008-6580 1 PoC Analysis EPSS 0.04

Red_Reservations - Unauthenticated Sensitive Information Exposure via Direct Database File Access

The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request to (1) makered.mdb and (2) makered97.mdb.

CWE-264 Apr 02, 2009 STIX 2.1

CVE-2008-6528 1 PoC Analysis EPSS 0.14

TmaxSoft JEUS 5 - Unauthenticated Source Code Disclosure via NTFS Alternate Data Stream

NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to the URL, which accesses the alternate data stream.

CWE-20 Mar 26, 2009 STIX 2.1

CVE-2008-6367 1 PoC Analysis EPSS 0.03

Social Groupie - Authenticated Arbitrary File Upload via Photos/create_album.php

Unrestricted file upload vulnerability in Photos/create_album.php in Social Groupie allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in Member_images/.

CWE-20 Mar 02, 2009 STIX 2.1

CVE-2008-6358 1 PoC Analysis EPSS 0.00

Social Groupie - SQL Injection via id Parameter

SQL injection vulnerability in group_index.php in Social Groupie allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 Mar 02, 2009 STIX 2.1

CVE-2008-6355 1 PoC Analysis EPSS 0.05

ASPired2Protect - Unauthenticated Sensitive Information Exposure via Direct Database Download

The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to ASPired2Protect.mdb.

CWE-264 Mar 02, 2009 STIX 2.1

CVE-2008-6353 1 PoC Analysis EPSS 0.00

ASP-CMS 1.0 - SQL Injection via cha Parameter

SQL injection vulnerability in index.asp in ASP-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cha parameter.

CWE-89 Mar 02, 2009 STIX 2.1

CVE-2008-6352 1 PoC Analysis EPSS 0.00

Xpoze Pro 4.10 - SQL Injection via Menu Parameter

SQL injection vulnerability in home.html in Xpoze Pro 4.10 allows remote attackers to execute arbitrary SQL commands via the menu parameter.

CWE-89 Mar 02, 2009 STIX 2.1

CVE-2008-5931 1 PoC Analysis EPSS 0.06

Net Guys ASPired2Blog - Info Disclosure

The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for admin/blog.mdb. NOTE: some of these details are obtained from third party information.

CWE-264 Jan 21, 2009 STIX 2.1

CVE-2008-5930 1 PoC Analysis EPSS 0.00

The Net Guys ASPired2Blog - SQL Injection

SQL injection vulnerability in admin/blog_comments.asp in The Net Guys ASPired2Blog allows remote attackers to execute arbitrary SQL commands via the BlogID parameter.

CWE-89 Jan 21, 2009 STIX 2.1

CVE-2008-5929 1 PoC Analysis EPSS 0.05

VP-ASP Shopping Cart 6.50 - Info Disclosure

VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database containing the password via a direct request for database/shopping650.mdb. NOTE: some of these details are obtained from third party information.

CWE-264 Jan 21, 2009 STIX 2.1

CVE-2008-5921 1 PoC Analysis EPSS 0.00

Umer Inc Songs Portal - SQL Injection

SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 Jan 21, 2009 STIX 2.1

CVE-2008-4255 1 PoC Analysis EPSS 0.66

Microsoft Office Frontpage - Memory Corruption

Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."

CWE-119 Dec 10, 2008 STIX 2.1

CVE-2008-6581 1 PoC Analysis EPSS 0.04

PhpAddEdit 1.3 - Unauthenticated Authentication Bypass via addedit Cookie

login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter.

CWE-287 Apr 02, 2009 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps