Latest Vulnerabilities with Public Exploits

Updated 3h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

369,061 CVEs tracked 55,209 with exploits 5,127 exploited in wild 1,653 CISA KEV 4,257 Nuclei templates 56,226 vendors 49,167 researchers

55,209 results Clear all

CVE-2008-2419 1 PoC Analysis EPSS 0.07

Mozilla Firefox 2.0.0.14 - Remote Code Execution via Iframe Java Applet Error

Mozilla Firefox 2.0.0.14 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code by triggering an error condition during certain Iframe operations between a JSframe write and a JSframe close, as demonstrated by an error in loading an empty Java applet defined by a 'src="javascript:"' sequence.

CWE-399 May 23, 2008 STIX 2.1

CVE-2008-2421 1 PoC Analysis EPSS 0.02

SAP Web Application Server 7.0 - Cross-Site Scripting via PATH_INFO to Web GUI

Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under bc/gui/sap/its/webgui/.

CWE-79 May 23, 2008 STIX 2.1

CVE-2008-1331 1 PoC Analysis EPSS 0.09

OmniPCX Office OXO210 < 210/091.001 and OXO600 < 610/014.001 - Remote Command Execution via FastJSData.cgi id2 Parameter

cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001, OXO600 before 610/014.001, and other versions, allows remote attackers to execute arbitrary commands and "obtain OXO resources" via shell metacharacters in the id2 parameter.

CWE-20 Apr 02, 2008 STIX 2.1

CVE-2008-3331 1 PoC Analysis EPSS 0.04

Mantis < 1.1.2 - Cross-Site Scripting via return_dynamic_filters.php filter_target Parameter

Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in Mantis before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the filter_target parameter.

CWE-79 Jul 27, 2008 STIX 2.1

CVE-2008-3332 1 PoC Analysis EPSS 0.09

Mantis < 1.1.2 - Authenticated Remote Code Execution via adm_config_set.php Value Parameter

Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter.

CWE-94 Jul 27, 2008 STIX 2.1

CVE-2008-2477 1 PoC Analysis EPSS 0.01

MxBB Portal 2.7.3 - SQL Injection via Page Parameter

SQL injection vulnerability in index.php in MxBB (aka MX-System) Portal 2.7.3 allows remote attackers to execute arbitrary SQL commands via the page parameter.

CWE-89 May 28, 2008 STIX 2.1

CVE-2008-2456 1 PoC Analysis EPSS 0.01

ComicShout < 2.5 - SQL Injection via comic_id Parameter

SQL injection vulnerability in index.php in ComicShout 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the comic_id parameter.

CWE-89 May 27, 2008 STIX 2.1

CVE-2008-2457 1 PoC Analysis EPSS 0.01

bitmixsoft php-jokesite 2.0 - SQL Injection via cat_id Parameter

SQL injection vulnerability in jokes_category.php in PHP-Jokesite 2.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.

CWE-89 May 27, 2008 STIX 2.1

CVE-2008-2458 1 PoC Analysis EPSS 0.01

Starsgames Control Panel < 4.6.2 - Cross-Site Scripting via st Parameter

Cross-site scripting (XSS) vulnerability in index.php in Starsgames Control Panel 4.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the st parameter.

CWE-79 May 27, 2008 STIX 2.1

CVE-2008-2459 1 PoC Analysis EPSS 0.02

EntertainmentScript 1.4.0 - Path Traversal via Page Parameter

Directory traversal vulnerability in page.php in EntertainmentScript 1.4.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.

CWE-22 May 27, 2008 STIX 2.1

CVE-2008-2422 1 PoC Analysis EPSS 0.01

Webslider - SQL Injection

SQL injection vulnerability in index.php in Web Slider 0.6 allows remote attackers to execute arbitrary SQL commands via the slide parameter in a slides action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CWE-89 May 23, 2008 STIX 2.1

CVE-2008-2398 EXPLOITED 1 PoC Analysis NUCLEI EPSS 0.06

AppServ < 2.5.10 - Cross-Site Scripting via appservlang Parameter

Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the appservlang parameter.

CWE-79 May 21, 2008 STIX 2.1

CVE-2008-2276 1 PoC Analysis EPSS 0.03

Mantis 1.1.1 - Cross-Site Request Forgery via manage_user_create.php

Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users via a crafted link.

CWE-352 May 16, 2008 STIX 2.1

CVE-2008-6632 1 PoC Analysis EPSS 0.01

MercuryBoard <= 1.1.5 - SQL Injection via User-Agent HTTP Header

SQL injection vulnerability in func/login.php in MercuryBoard 1.1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header ($_SERVER['HTTP_USER_AGENT']).

CWE-89 Apr 07, 2009 STIX 2.1

CVE-2008-2478 1 PoC Analysis EPSS 0.04

cPanel < 11.8.6 and < 11.23.1 - Authenticated Remote Code Execution via Email Address Field

scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel.

CWE-94 May 28, 2008 STIX 2.1

CVE-2008-2393 1 PoC Analysis EPSS 0.01

EntertainmentScript 1.4.0 - SQL Injection via play.php id Parameter

SQL injection vulnerability in play.php in EntertainmentScript 1.4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 May 21, 2008 STIX 2.1

CVE-2008-2395 1 PoC Analysis EPSS 0.01

AlkalinePHP < 0.80.00 - SQL Injection via Thread ID Parameter

SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

CWE-89 May 21, 2008 STIX 2.1

CVE-2008-2396 1 PoC Analysis EPSS 0.02

microSSys CMS < 1.5 - Remote Code Execution via PAGES Array Parameter

PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in an arbitrary element of the PAGES array parameter.

CWE-94 May 21, 2008 STIX 2.1

CVE-2008-2350 1 PoC Analysis EPSS 0.03

bcoos 1.0.9-1.0.13 - Path Traversal via File Parameter

Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1) .. (dot dot) or (2) C: folder sequences in the file parameter.

CWE-22 May 20, 2008 STIX 2.1

CVE-2008-2394 1 PoC Analysis EPSS 0.01

TAGWORX.CMS 3.00.02 - SQL Injection via cid or nid Parameter

Multiple SQL injection vulnerabilities in TAGWORX.CMS 3.00.02 allow remote attackers to execute arbitrary SQL commands via the (1) cid parameter to contact.php and the (2) nid parameter to news.php.

CWE-89 May 21, 2008 STIX 2.1

Latest Vulnerabilities with Public Exploits

Investigate

Ecosystems

Reference Indexes

Recent Blog Posts

CVEForge Labs

KEV Gaps