Latest Vulnerabilities with Public Exploits

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

351,821 CVEs tracked 54,182 with exploits 4,984 exploited in wild 1,602 CISA KEV 4,130 Nuclei templates 54,504 vendors 46,761 researchers

54,182 results Clear all

CVE-2008-2074 1 PoC Analysis EPSS 0.04

Harris Wap Chat 1.0 - Remote Code Execution via sysFileDir Parameter

Multiple PHP remote file inclusion vulnerabilities Harris Yusuf Arifin Harris Wap Chat 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the sysFileDir parameter to (1) eng.writeMsg.php, (2) eng.adCreate.php, (3) eng.adCreateSave.php, (4) eng.adDispByTypeOptions.php, (5) eng.createRoom.php, (6) eng.forward.php, (7) eng.pageLogout.php, (8) eng.resultMember.php, (9) eng.roomDeleteConfirm.php, (10) eng.saveNewRoom.php, and (11) eng.searchMember.php in src/.

CWE-94 May 05, 2008 STIX 2.1

CVE-2008-4913 1 PoC Analysis EPSS 0.04

LokiCMS <= 0.3.3 - Unauthenticated Arbitrary File Deletion via Admin.php Delete Parameter

Directory traversal vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to delete arbitrary files via a .. (dot dot) in the delete parameter.

CWE-22 Nov 04, 2008 STIX 2.1

CVE-2008-2045 1 PoC Analysis EPSS 0.12

SugarCRM 4.5.1 and 5.0.0 - Path Traversal via URL Parameter in Feed.php

Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in the URL parameter to modules/Feeds/Feed.php, which places the contents into a related cache file in the .cache/feeds directory.

CWE-22 May 01, 2008 STIX 2.1

CVE-2008-2040 1 PoC Analysis EPSS 0.33

Peercast 0.1218 - Stack-based Buffer Overflow in HTTP Basic Authentication

Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-peercast allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Basic Authentication string with a long (1) username or (2) password.

CWE-119 Apr 30, 2008 STIX 2.1

CVE-2008-2087 1 PoC Analysis EPSS 0.01

Softbiz Web Hosting Directory Script - SQL Injection via search_result.php host_id Parameter

SQL injection vulnerability in search_result.php in Softbiz Web Host Directory Script, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the host_id parameter, a different vector than CVE-2005-3817.

CWE-89 May 06, 2008 STIX 2.1

CVE-2008-2083 1 PoC Analysis EPSS 0.01

Prozilla Hosting Index - SQL Injection via cat_id Parameter

SQL injection vulnerability in directory.php in Prozilla Hosting Index, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.

CWE-89 May 05, 2008 STIX 2.1

CVE-2008-2063 1 PoC Analysis EPSS 0.01

Joovili 3.1 - SQL Injection via Category Parameter

SQL injection vulnerability in browse.videos.php in Joovili 3.1 allows remote attackers to execute arbitrary SQL commands via the category parameter.

CWE-89 May 02, 2008 STIX 2.1

CVE-2008-2069 1 PoC Analysis EPSS 0.18

Novell GroupWise 7 - Buffer Overflow via Long Argument in mailto: URI

Buffer overflow in Novell GroupWise 7 allows remote attackers to cause a denial of service or execute arbitrary code via a long argument in a mailto: URI.

CWE-119 May 02, 2008 STIX 2.1

CVE-2008-1084 2 PoCs Analysis EPSS 0.12

Microsoft Windows Kernel - Local Code Execution via NtUserFnOUTSTRING Input Validation

Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, through Vista SP1, and Server 2008 allows local users to execute arbitrary code via unknown vectors related to improper input validation. NOTE: it was later reported that one affected function is NtUserFnOUTSTRING in win32k.sys.

CWE-94 Apr 08, 2008 STIX 2.1

CVE-2008-6642 1 PoC Analysis EPSS 0.00

DotContent FluentCMS 4.x - SQL Injection via view.php sid Parameter

SQL injection vulnerability in view.php in DotContent FluentCMS 4.x allows remote attackers to execute arbitrary SQL commands via the sid parameter. NOTE: some of these details are obtained from third party information.

CWE-89 Apr 07, 2009 STIX 2.1

CVE-2008-2390 1 PoC Analysis EPSS 0.05

HP Software Update - Remote Code Execution via Hpufunction.dll Execute Methods

Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods, which allows remote attackers to execute arbitrary code via an absolute pathname in the first argument.

CWE-94 May 21, 2008 STIX 2.1

CVE-2008-2217 1 PoC Analysis EPSS 0.04

Content Management System 0.6.1 - Path Traversal via cm_imgpath Parameter

Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cm_imgpath parameter.

CWE-22 May 14, 2008 STIX 2.1

CVE-2008-2065 1 PoC Analysis EPSS 0.01

YourFreeWorld Jokes Site Script - SQL Injection via Jokes.php Catagorie Parameter

SQL injection vulnerability in jokes.php in YourFreeWorld Jokes Site Script allows remote attackers to execute arbitrary SQL commands via the catagorie parameter.

CWE-89 May 02, 2008 STIX 2.1

CVE-2008-2022 1 PoC Analysis EPSS 0.03

MegaBBS 2.2 - Cross-Site Scripting via toid Parameter

Mulatiple cross-site scripting (XSS) vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) toid parameter to send-private-message.asp and the (2) redirect parameter to admin/impersonate.asp. NOTE: vector 2 requires authentication.

CWE-79 Apr 30, 2008 STIX 2.1

CVE-2008-2023 1 PoC Analysis EPSS 0.01

PD9 Software MegaBBS 2.2 - SQL Injection

Multiple SQL injection vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) invisible and (2) timeoffset parameters to profile/controlpanel.asp and the (3) attachmentid parameter to forums/attach-file.asp.

CWE-89 Apr 30, 2008 STIX 2.1

CVE-2008-1559 2 PoCs Analysis EPSS 0.00

Joomla! com_alphacontent 2.5.8 - SQL Injection

SQL injection vulnerability in the Bernard Gilly AlphaContent (com_alphacontent) 2.5.8 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.

CWE-89 Mar 31, 2008 STIX 2.1

CVE-2008-2088 1 PoC Analysis EPSS 0.01

PHP Forge 3.0 beta 2 - SQL Injection via News Module id Parameter

SQL injection vulnerability in admin/news.php in PHP Forge 3.0 beta 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in the news module to admin.php.

CWE-89 May 06, 2008 STIX 2.1

CVE-2008-2081 1 PoC Analysis EPSS 0.03

Siteman 2.0.x2 - Authenticated Path Traversal via Module Parameter

Directory traversal vulnerability in index.php in Siteman 2.0.x2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the module parameter.

CWE-22 May 05, 2008 STIX 2.1

CVE-2008-2082 2 PoCs Analysis EPSS 0.03

Siteman 2.0.x2 - Cross-Site Scripting via Module Parameter

Cross-site scripting (XSS) vulnerability in index.php in Siteman 2.0.x2 allows remote attackers to inject arbitrary web script or HTML via the module parameter, which leaks the path in an error message.

CWE-79 May 05, 2008 STIX 2.1

CVE-2008-2084 1 PoC Analysis EPSS 0.00

MyArticles 0.6 beta-1 - SQL Injection via topic_id Parameter

SQL injection vulnerability in topics.php in the MyArticles 0.6 beta-1 module for RunCMS allows remote attackers to execute arbitrary SQL commands via the topic_id parameter in a listarticles action.

CWE-89 May 05, 2008 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps