Latest Vulnerabilities with Public Exploits

Updated 4h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

366,346 CVEs tracked 55,148 with exploits 5,114 exploited in wild 1,647 CISA KEV 4,232 Nuclei templates 56,093 vendors 48,920 researchers

55,148 results Clear all

CVE-2008-0251 1 PoC Analysis EPSS 0.04

PhotoPost vBGallery < 2.4.1 - Unauthenticated Arbitrary File Upload

Unrestricted file upload vulnerability in PhotoPost vBGallery before 2.4.2 allows remote attackers to upload and execute arbitrary files via unknown vectors.

CWE-20 Jan 12, 2008 STIX 2.1

CVE-2008-3918 2 PoCs Analysis EPSS 0.01

Ovidentia 6.6.5 - SQL Injection via Search Field Parameter

SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the field parameter in a search action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-89 Sep 04, 2008 STIX 2.1

CVE-2008-4454 2 PoCs Analysis EPSS 0.02

MySQL Quick Admin 1.5.5 - Path Traversal via Lang Parameter

Directory traversal vulnerability in EKINdesigns MySQL Quick Admin 1.5.5 allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the lang parameter to actions.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-22 Oct 06, 2008 STIX 2.1

CVE-2008-6126 1 PoC Analysis EPSS 0.03

moziloCMS <= 1.10.2 - Path Traversal via Download and Index Page Parameters

Multiple directory traversal vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to download.php and the (2) page parameter to index.php, a different vector than CVE-2008-3589.

CWE-22 Feb 13, 2009 STIX 2.1

CVE-2008-2197 2 PoCs Analysis EPSS 0.01

Miniweb2 blog_writer 2.0 - SQL Injection via Historymonth Parameter

SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter to index.php.

CWE-89 May 14, 2008 STIX 2.1

CVE-2008-6788 2 PoCs Analysis EPSS 0.01

MindDezign Photo Gallery 2.2 - SQL Injection via id Parameter

SQL injection vulnerability in MindDezign Photo Gallery 2.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in an info action to index.php.

CWE-89 May 04, 2009 STIX 2.1

CVE-2008-4896 1 PoC Analysis EPSS 0.01

Logz CMS 1.3.1 - Cross-Site Scripting via Art Parameter

Cross-site scripting (XSS) vulnerability in fichiers/add_url.php in Logz CMS 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the art parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-79 Nov 04, 2008 STIX 2.1

CVE-2008-6590 1 PoC Analysis EPSS 0.03

LightNEasy 1.2.2 - Path Traversal via Page Parameter

Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to read arbitrary files via a .. (dot dot) in the page parameter to (1) index.php and (2) LightNEasy.php.

CWE-22 Apr 03, 2009 STIX 2.1

CVE-2008-6647 2 PoCs Analysis EPSS 0.01

Ktools PhotoStore 3.4.3 - SQL Injection via Gallery gid Parameter

SQL injection vulnerability in gallery.php in Ktools PhotoStore 3.4.3 allows remote attackers to execute arbitrary SQL commands via the gid parameter.

CWE-89 Apr 07, 2009 STIX 2.1

CVE-2008-6648 2 PoCs Analysis EPSS 0.01

Ktools PhotoStore 3.4.3 and 3.5.2 - SQL Injection via gid Parameter

SQL injection vulnerability in crumbs.php in Ktools PhotoStore 3.4.3 and 3.5.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter to about_us.php. NOTE: this might be the same issue as CVE-2008-6647.

CWE-89 Apr 07, 2009 STIX 2.1

CVE-2008-0754 1 PoC Analysis EPSS 0.01

Joomla com_rapidrecipe 1.6.5 - SQL Injection via user_id or category_id Parameter

Multiple SQL injection vulnerabilities in index.php in the Rapid Recipe (com_rapidrecipe) 1.6.5 component for Joomla! allow remote attackers to execute arbitrary SQL commands via (1) the user_id parameter in a showuser action or (2) the category_id parameter in a viewcategorysrecipes action.

CWE-89 Feb 13, 2008 STIX 2.1

CVE-2008-2630 2 PoCs Analysis EPSS 0.01

JooBlog (com_jb2) 0.1.1 - SQL Injection via CategoryID Parameter

SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter in a category action to index.php.

CWE-89 Jun 10, 2008 STIX 2.1

CVE-2008-5864 4 PoCs Analysis EPSS 0.02

com_tophotelmodule 1.0 - SQL Injection via id Parameter

SQL injection vulnerability in the Top Hotel (com_tophotelmodule) component 1.0 in the Hotel Booking Reservation System (aka HBS) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showhoteldetails action to index.php.

CWE-89 Jan 06, 2009 STIX 2.1

CVE-2008-5865 4 PoCs Analysis EPSS 0.01

Hotel Booking Reservation System 1.0.0 - com_hbssearch - SQL Injection

SQL injection vulnerability in the com_hbssearch component 1.0 in the Hotel Booking Reservation System (aka HBS) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the r_type parameter in a showhoteldetails action to index.php.

CWE-89 Jan 06, 2009 STIX 2.1

CVE-2008-5874 3 PoCs Analysis EPSS 0.01

Hotel Booking Reservation System - Joomla! SQL Injection

Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS) for Joomla! allow remote attackers to execute arbitrary SQL commands via the id parameter in a showhoteldetails action to index.php in the (1) com_allhotels or (2) com_5starhotels module. NOTE: some of these details are obtained from third party information.

CWE-89 Jan 08, 2009 STIX 2.1

CVE-2008-0685 2 PoCs Analysis EPSS 0.01

iTechClassifieds 3.0 - SQL Injection via ViewCat.php CatID Parameter

SQL injection vulnerability in ViewCat.php in iTechClassifieds 3.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.

CWE-89 Feb 12, 2008 STIX 2.1

CVE-2008-2996 2 PoCs Analysis EPSS 0.01

Gravity Board X 2.0 Beta - SQL Injection via searchquery or board_id Parameter

Multiple SQL injection vulnerabilities in index.php in Gravity Board X (GBX) 2.0 Beta, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) searchquery parameter in a getsearch action, and the (2) board_id parameter in a viewboard action.

CWE-89 Jul 03, 2008 STIX 2.1

CVE-2008-5778 2 PoCs Analysis EPSS 0.01

Free Links Directory Script 1.2a - SQL Injection

SQL injection vulnerability in report.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL commands via the linkid parameter.

CWE-89 Dec 30, 2008 STIX 2.1

CVE-2008-5779 2 PoCs Analysis EPSS 0.01

Free Links Directory Script <1.2a - SQL Injection

SQL injection vulnerability in lpro.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 Dec 30, 2008 STIX 2.1

CVE-2008-5759 1 PoC Analysis EPSS 0.01

FlatnuX CMS 2008-12-11 - Cross-Site Scripting via Name Parameter in 08_Files Module

Cross-site scripting (XSS) vulnerability in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allows remote attackers to inject arbitrary web script or HTML via the name parameter in an updaterecord action to index.php in the 08_Files module. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-79 Dec 30, 2008 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps